How do I get timeColumnName to read as "July"? It needs to be dynamic. Keying off of the eval or something similar.
index="main" |eval timeColumnName=strftime(_time, "%b %d")|stats sparkline AS timeColumnName count by userName
The solution should easily work with
index="main" |eval timeColumnName=strftime(_time, "%b %d")|stats sparkline AS timeColumnName count by userName
Explicitly renaming |rename timeColumnName AS July is not what I'm looking for. I don't want to update the code in August.
For the first example, output should look like:
userName July Count
userA prettyGraphic, use your imagination 54
userB prettyGraphic 23
and example 2 should have the date for an individual day
userName July 12 Count
userA prettyGraphic, use your imagination 54
userB prettyGraphic 23
sadly the output currently looks like
userName timeColumnName Count
userA prettyGraphic, use your imagination 54
userB prettyGraphic 23
Thanks in advance for any ideas.
... View more