Here is the search I'm running:
index=cdb_summary source=CDM_*_Daily_Summary fismaid=* sourcetype=swam_summary OR sourcetype=hwam_summary
| stats sum(TotalManaged) as TotalApplicable,count(eval(AutoFail=="False")) as GoodAssets , sum(NotScanned) as NotScanned,values(FailedCPE) as FailedCPEs, count(FailedCPE) as FailedCPE
| eval SWAM_Score=round((TotalApplicable-NotScanned-FailedCPE)/TotalApplicable*100)
I'd like to get results from each day within a given timeframe to use for the ML Toolkit. I've tried timewrap, but it returns no results. How can I get a search to run this query for each day in a given timeframe?
index=cdb_summary source=CDM_*_Daily_Summary fismaid=* sourcetype=swam_summary OR sourcetype=hwam_summary
| bin span=1d _time
| stats sum(TotalManaged) as TotalApplicable,count(eval(AutoFail=="False")) as GoodAssets , sum(NotScanned) as NotScanned,values(FailedCPE) as FailedCPEs, count(FailedCPE) as FailedCPE by _time
| eval SWAM_Score=round((TotalApplicable-NotScanned-FailedCPE)/TotalApplicable*100)
I am not sure if I understand your question right but if you want to have the results for just a timeframe of some days for example every day from 05:00 to 23:00 you can add somethin like that:
......| eval eventHour=strftime(_time,"%H") | search eventHour>5 AND eventHour<23
for whole days i would use:
| timchart span=%%
with the span you want to compare.
Currently the search gives a single row of data for whatever length of time I select. I want it to give a row for every day in the length of time I select so I can do some analysis with the numbers.
I tried the timechart recommendation, and get the following errors:
index=cdb_summary source=CDM_*_Daily_Summary fismaid=* sourcetype=swam_summary OR sourcetype=hwam_summary
| bin span=1d _time
| stats sum(TotalManaged) as TotalApplicable,count(eval(AutoFail=="False")) as GoodAssets , sum(NotScanned) as NotScanned,values(FailedCPE) as FailedCPEs, count(FailedCPE) as FailedCPE by _time
| eval SWAM_Score=round((TotalApplicable-NotScanned-FailedCPE)/TotalApplicable*100)