topic Line Chart with a day wise usage count in Dashboards & Visualizations

Line Chart with a day wise usage count

zacksoft — Tue, 29 Sep 2020 17:07:43 GMT

I want to know how frequently a keyword is found(from the list of events) and see it in a time chart.
This is the search I am using, I am not sure if I am using it correct .
And there is a null line found in the line chart.

host= "HostA" or "HostB" "videostreamed"
| eval view=if(like(_raw,"%videostreamed%"),"Prime_Streamed"
| timechart span=1d count by view

I want to know the amount of events generated with the key word "videostreamed" based on the base-search I have, on a daily basis in a line chart.
Example : if the linechart has a spike on Monday, It should mean more events found with the videostreamed
The more the number of events, the higher is the usage that day.

I hope I am clear with my explanation

Re: Line Chart with a day wise usage count

HiroshiSatoh — Mon, 04 Dec 2017 11:06:38 GMT

I think that this alone is good.

host= "HostA" or "HostB" "videostreamed"
| timechart span=1d count

Do you also need a number that does not match?

Re: Line Chart with a day wise usage count

zacksoft — Mon, 04 Dec 2017 11:08:58 GMT

yes, That would help too.

Re: Line Chart with a day wise usage count

ppuru — Tue, 29 Sep 2020 17:07:46 GMT

You may want to consider assigning a number to it.
index=* | eval Text_Found = if(like(_raw,"%GET%"),"1","0") | where Text_Found=1 | timechart span=1m count by Text_Found

Re: Line Chart with a day wise usage count

woodcock — Tue, 05 Dec 2017 03:12:45 GMT

I think this:

host= "HostA" or "HostB" 
| timechart span=1d count count(eval(searchmatch("videostreamed"))) AS Prime_Streamed BY view

Or, probably you'd like this better:

host= "HostA" or "HostB" 
| bucket _time span=1d 
| stats count count(eval(searchmatch("videostreamed"))) AS Prime_Streamed BY view_time
| eval pct = 100 * Prime_Streamed / count
| timechart span=1d avg(pct) AS pct BY view