I need to display trending IP events over the course of 90 days with each day being a sum of the events.
My original query which was only interested in daily metrics on a more granular level uses stats > sort > addcoltotal. I need to retain the sorting behavior as I am only interested in the top-20 IPs currently. I've been able to get the daily totals I am interested in but I am not sure how to repeat the query across the 90 days and translate that into a timechart.
... base
| fields ip email username inf ssr
| stats count(ip) as ar count(ssr) as ssre count(eval(inf)) as ssby count(eval(inf="success")) as ls count(eval(inf="warning")) as lf dc(eval(coalesce(email, username))) as ua by ip
| sort 20 -ar
| stats sum(ar) as auth_requests sum(ssre) as ss_redirect sum(ssby) as ss_bypass sum(ls) as login_success sum(lf) as login_failure sum(ua) as unique_accounts
