Show the sum of an event per day by user in Splunk

Viewed 24

I want to be able to show the sum of an event (let's say clicks) per day but broken down by user type. The results I'm looking for will look like this:

User Role 01/01 01/02 01/03 ...
Guest 500 450 348 55
Admin 220 200 150 75

Here is my initial start but I'm unsure how to do the pivots on this to produce a table and visual chart

earliest=-30d index=* role=Guest OR role=Admin | count clicks as clickCount | ...

I'm unsure on how to both only count by day but then also only count by role to render them as shown above. Thanks for the help in advance.

0 Answers
Related