Dashboards & Visualizations

How to edit my search to create a dashboard that displays an event count per hour with weekly total?

Engager

Hello, I have the following simple query;

index="myindex" source="*sourcelog.txt" "KEYWORD"

This search returns about 90,000 events over a given week with "KEYWORD" in it. How can I create a dashboard that shows me how many events per hour and day over that week, along with a running weekly total?

Thanks in advance for your help guys.

0 Karma
1 Solution

Legend

Like this

index="myindex" source="*sourcelog.txt" "KEYWORD" earliest=-7d@d | timechart span=1h count | accum count

View solution in original post

0 Karma

Legend

Like this

index="myindex" source="*sourcelog.txt" "KEYWORD" earliest=-7d@d | timechart span=1h count | accum count

View solution in original post

0 Karma

Engager

This is close.

This shows a contiguous count spanning across 7 days. I would like an individual count per hour and then a summation of all counts per week. Is this possible?

0 Karma

Legend

Are you showing more than 1 week's worth of data?

0 Karma

Engager

No, I am limiting the search to "Week To Date"

0 Karma

Legend

So what do you want for summation per week? Just the total for the entire week? Would that be total of count? Do you want the summation at the bottom or as an additional field? For summation at the bottom, add this to the end of the query

... | addcoltotals labelfield=_time label="Week Total"

If you want as an additional field, add this to the end

... | eval wknum=strftime(_time, "%U") | eventstats sum(count) as wk_total by wknum | fields - wknum
0 Karma