| splunk-instance-livesearch-field | index=apache /download/attachments/114491421/ | eval Filename=Replace(uri_path,"/download/attachments/114491421/","")| eval Filename=urldecode(Filename) | timechart count by usenull=f useother=f limit=0 Filename span=1d |
|---|
| chartName | Column Chart |
|---|
| splunk-instance-field | 0 |
|---|
| chartStackMode | Not stacked |
|---|
| splunk-stackmode | default |
|---|
| splunk-chart-field | COLUMN |
|---|
| projectName | splunk.mos-eisley.dk |
|---|
|