| splunk-instance-livesearch-field | index=apache /download/attachments/114491421/ | eval Filename=Replace(uri_path,"/download/attachments/114491421/","")| eval Filename=Replace(Filename,"%20","") | eval Filename=urldecode(Replace(Filename,"%2C",",")) | timechart count by Filename span=1d |
|---|
| chartName | Column Chart |
|---|
| splunk-instance-field | 0 |
|---|
| chartStackMode | Not stacked |
|---|
| splunk-stackmode | default |
|---|
| splunk-chart-field | COLUMN |
|---|
| projectName | splunk.mos-eisley.dk |
|---|
|