Hi,
in my scenario i have a lot of users for example: user1, user2, user3... and i want to count their logins to a server and create a pie chart. I have the problem that there are some users which have the same name but a different notation for example user1, USER1 and USer1. How can i sum the counts of these 3, allocate it to user1 and create the pie chart?
Thx for your help!
Hi reschal,
you can lower the user names.
Can you please try this?
YOUR_SEARCH | eval user_field =lower(user_field) | stats count by user_field
just add extra eval before stats command.
thanks
Hi reschal,
you can lower the user names.
Can you please try this?
YOUR_SEARCH | eval user_field =lower(user_field) | stats count by user_field
just add extra eval before stats command.
thanks
Thanks, it works 🙂
Hi
Can you please accept this question to mark as close?