Archive

eventcount - spanning over week

Contributor

I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetype per day of a span of week. Can I use evencount for this? I'm not having much luck.

| eventcount summarize=false index=myindex sourcetype=mysourcetype | timechart span=1d count
Tags (1)
0 Karma