Hello,
I have a search that generates a statistics table based on the timerange I select.
How can I select, lets say, a timerange of 1 year and have the statistics generated and displayed over each month? I want to avoid manually having to change the time range to select each month, view statistics, etc...
This is my search
index=autosys source=
| where status="SUCCESS"
| eval startTimeEpoch = strptime(startTime, "%Y-%m-%d %H:%M:%S")
| eval startTimeHour = strftime(startTimeEpoch, "%H")
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S")
| eval endTimeHour = strftime(endTimeEpoch, "%H")
| eventstats count(startTimeHour) AS startHourCount by startTimeHour
| eventstats count(endTimeHour) As endHourCount by endTimeHour
| eventstats count(jobName) As RunCount by jobName
| eval startHourPercent = ((startHourCount / RunCount) * 100)
| eval endHourPercent = ((endHourCount / RunCount) * 100)
| eval roundedStartHourPercent =round(startHourPercent)
| eval roundedEndHourPercent =round(endHourPercent)
| dedup startTimeHour endTimeHour
| sort -roundedStartHourPercent
| sort -roundedEndHourPercent
| table jobName startTimeHour endTimeHour
