Hi,
I'm new to Splunk and have written a simple search to see 4 trending values over a month.
auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
This gives me the values per day of 4 different admin message types e,g
Message 1 Message 2 Message 3 Message 4
01/01/19 5 10 4 7
02/01/19 15 20 7 15
03/01/19 8 3 6 16
When this converts to a line chart in visualizations, it shows me the value per day. I want it to report the total per message as the month goes on so you see the cumulative values. e.g
Message 1 Message 2 Message 3 Message 4
01/01/19 5 10 4 7
02/01/19 20 30 11 22
03/01/19 28 33 17 34
Can anyone help?
Cheers
@jyar1,
Try this
auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count
@jyar1,
Try this
auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count
Thankyou does exactly what i want - however is there a way for formatting the X Axis in the visualization to remove the timestamp and just show the date?
i.e - it shows | 2019-01-01 T00:00:00+00:00 | 2019-01-02 T00:00:00+00:00
Can it be formatted to show
2019-01-01 | 2019-01-02 | 2019-01-03
yes, sure. Add below to the end of the search
eval _time=strftime(_time,"%Y-%m-%d")