Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to modify my timechart to get the results as i needed?

$
0
0
I have a search as follows in which I am trying to display 2 fields (My Search) | timechart span=1h count by field_username which displays the result as follows _time user_a user_b user_c user_d ---------------------------------- I don't want like this. All I am looking is as follows _time users_list_of_that_particullar_hour count_of_that_hour

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>