I would like to compare the same hour for the last seven days. Is there a chance of using timewrap for this?
Yes, you can use timewrap for this. Take a look at this run everywhere example:
index=_internal earliest=-7d@d latest=-0d@d source=*metrics.log | timechart span=1h sum(kb) by series | timewrap w | where strftime(_time, "%H") == "10"
This will get you a nice chart of the sum for kb per series out of the metrics.log and compares the results for each day at hour 10 over the last 7 days.
hope this helps ... and @carasso can agree on this ...
View solution in original post
Kristian's one will be efficient as it will get all the required values before creating the chart.
You might even make do with using the date_* default fields;
index=_internal earliest=-7d@d date_hour=10 | stats c by date_mday
It all depends on how you want to process and report on your data.