I want to know how frequently a keyword is found(from the list of events) and see it in a time chart.
This is the search I am using, I am not sure if I am using it correct .
And there is a null line found in the line chart.
host= "HostA" or "HostB" "videostreamed"
| eval view=if(like(_raw,"%videostreamed%"),"Prime_Streamed"
| timechart span=1d count by view
I want to know the amount of events generated with the key word "videostreamed" based on the base-search I have, on a daily basis in a line chart.
Example : if the linechart has a spike on Monday, It should mean more events found with the videostreamed
The more the number of events, the higher is the usage that day.
I hope I am clear with my explanation
I think that this alone is good.
host= "HostA" or "HostB" "videostreamed"
| timechart span=1d count
Do you also need a number that does not match?
I think this:
host= "HostA" or "HostB"
| timechart span=1d count count(eval(searchmatch("videostreamed"))) AS Prime_Streamed BY view
Or, probably you'd like this better:
host= "HostA" or "HostB"
| bucket _time span=1d
| stats count count(eval(searchmatch("videostreamed"))) AS Prime_Streamed BY view_time
| eval pct = 100 * Prime_Streamed / count
| timechart span=1d avg(pct) AS pct BY view
You may want to consider assigning a number to it.
index=* | eval Text_Found = if(like(_raw,"%GET%"),"1","0") | where Text_Found=1 | timechart span=1m count by Text_Found
I think that this alone is good.
host= "HostA" or "HostB" "videostreamed"
| timechart span=1d count
Do you also need a number that does not match?
yes, That would help too.