Hi, I have created a results chart using this search:
| dbquery "DBNAME" "SELECT useraction FROM usertable" | eval useraction=strftime(useraction,"%Y-%d-%m") | stats count by useraction
However there are no dates along the x axis, only the title of "useraction"
How can I get those there for context?
Thanks 🙂
I am not sure that this will work, but try
| dbquery "DBNAME" "SELECT useraction FROM usertable"
| eval useraction=strftime(useraction,"%Y-%d-%m")
| eval _time=strptime(useraction,"%Y-%d-%m")
| timechart span=5m count
Hopefully, this will build a timechart with 5 minute increments. You can set the span to something else if you want, but there is a limit to the number of datapoints that can be displayed in a chart. I forget what the limit it, but you should get an error message (red bar) if you try to exceed it.
Hi and thanks - this gives me No results found