I have an alert that runs every hour at the half hour mark. So at 1:30, 2:30, etc... When I run the timechart command, "| timechart count span=1h", it brings back the count of events for each hour, but I want the count of event from 1:30 to 2:30. How can I accomplish this?
(index=ABC Page="go.aspx" Refer="*signup_pro.aspx" UserName=*)
OR (index=ABC Page="signup_pro.aspx" (SID3Type=A1 OR SID3Type=A2) UserName=* SID1=* SID3=*)
OR (index=ABC Page="Registration.aspx" UserName=*)
| transaction UserName, SessionSID maxspan=60m
| table _time, UserName, SID3, SID3Type, SID1, FName1, LName1, Email, Page
| sort - _time
| search UserName=* SID1=* SID3=* SID3Type=* FName1=* LName1=* Email=* Page=go.aspx
| rename UserName AS UserSID, SID1 AS "SID1 (SSN)", FName1 AS FirstName, LName1 AS LastName
| fields - Page
↧