Hello,
I currently have a query like this:
| eventstats sum(total_dates_correct) as TOTAL_CORRECT | eventstats sum(total_datetypes) as TOTAL | eval TOTAL_ACCURACY = (TOTAL_CORRECT / TOTAL) * 100 | table _time TOTAL_ACCURACY | timechart avg(TOTAL_ACCURACY)
I would like to have it so that if the person selects a date range of 2019 for example, and a date interval of 1 month, then the TOTAL_ACCURACY above would be calculated individually for the events that lie within that month.
So for example:
Date range: 2019
Date interval: 1 month
January 2019 TOTAL_ACCURACY: 20% (Calculated using 100 logs from January)
February 2019 TOTAL_ACCURACY: 80% (Calculated using 10 logs from February)
March 2019 ...
etc
I guess it would be similar to setting the date range for a query to be from January 2019 to February 2019, saving that in a field, then February 2019 to March 2019, saving that in another field, etc. and then outputting it all on the same graph.
Ideally, I would create a dropdown input on the dashboard so that the user can choose the date interval (haven't looked into how this works yet)
How would I do this?
Thanks
You are correct. Use the standard Time picker
and a custom dropdown
field called interval
pre-populated with values like {1s, 1m, 1h, 1d, 1month, 1y}
. Then your search would look like this:
... | bin _time span=$span_token$
| stats sum(total_dates_correct) AS TOTAL_CORRECT sum(total_datetypes) AS TOTAL BY _time
| eval TOTAL_ACCURACY = 100 * (TOTAL_CORRECT / TOTAL)
| timechart span=$span_token$ avg(TOTAL_ACCURACY) AS TOTAL_ACCURACY
you should consider using the bucket command. you'll have to configure your input to feed the appropriate span to bucket
For example
|bucket span=1mon _time
| eventstats sum(total_dates_correct) as TOTAL_CORRECT by _time
| eventstats sum(total_datetypes) as TOTAL by _time
| eval TOTAL_ACCURACY = (TOTAL_CORRECT / TOTAL) * 100
| table _time TOTAL_ACCURACY
| timechart avg(TOTAL_ACCURACY)