Splunk Search

Simple Search

nebel
Communicator

Hi there,

maybe its not my day today, struggeling since hours with this case 😉

Per User means one connection. Now I want to count them and bring them into a timechart.

Event:
user
peter
frank
marcus

Every 10 minutes I get a event with the Users. Now I want to count them (3) and display the amount of connections in a timechart.

Thank you very much

Regards

Tags (1)
0 Karma
1 Solution

nebel
Communicator

index=user_db earliest=-24h | multikv fields user | timechart span=10m count AS Connections

View solution in original post

0 Karma

nebel
Communicator

index=user_db earliest=-24h | multikv fields user | timechart span=10m count AS Connections

0 Karma

nebel
Communicator

I built the following search:

index=user_db | multikv fields user | timechart span=10m count by user

it works, but I don't want to display single user in my graph, only the amount of connections. How can I realize that?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...