Hi
i have a requirement to create a dashboard to represent total events
i have created a panel in the dashboard which refreshes for every 5 mins.
I need to add the new results to the existing count and show it on screen
i tried using streamstats and dashboard seems freezing when it tries to refresh
any help or advise is if great help
Thanks
Sandeep
In most cases, your search time range should accommodate this directly.
For example, to show today's current count on refresh, set the time range to earliest=@d latest=now in whichever way makes sense for your dashboard:
| tstats count where sourcetype=example earliest=@d latest=now
If your solution is more complex than that, please provide an example.