How to make Linechart of users logged in throughout the day with tstats?

[powermundsen]

I want to make a linechart of users in a division logged in throughout the day, but I can't make the tstat search work with linechart. The count works fine but I want to group the users by 30 minutes.

A typical users are:
COMPANY\HR94832
COMPANY\AC49328

So I have to filter the user with "COMPANY\HR*.
| tstats summariesonly=true allow_old_summaries=true
dc(Session_SessionDetail.SessionUser) as Users
from datamodel=uberAgent.Session_SessionDetail
where Session_SessionDetail.SessionUser = "COMPANY\HR*" by _time

[somesoni2 · Accepted solution]

You just need to add span in your tstats command, like this

| tstats summariesonly=true allow_old_summaries=true
dc(Session_SessionDetail.SessionUser) as Users
from datamodel=uberAgent.Session_SessionDetail 
where Session_SessionDetail.SessionUser = "COMPANY\\HR*" by _time span=30m

See this for more information on this option
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Tstats#BY_clause_arguments

[renjith_nair]

Hi @powermundsen,

What about adding |bin span=30m _time|stats sum(count) by _time,sourcetype to end of your search