I'm wanting to create a visualization that shows the average amount of errors during each minute of the day over a period of time. I can do it for each hour of the day:
index=ind sourcetype=sotp "error"
| bin _time span=1h
| eval date_hour=strftime(_time, "%H")
| stats count AS hits first(date_hour) AS date_hour BY _time
| stats median(hits) BY date_hour
I can also do it for minute of the hour, but not minute of the day. It would be nice to have more granularity.
Thanks