searches based on time range in a one graph

[Khushboo]

Hi Team,

I have query like following :

index=something  earliest=-7d latest=now()
| stats count by page

where i need to calculate how many hits page is getting in last 1 hour, 4 hours, 24 hours and last weeks

how do i join these search to draw one line graph from it.

[Khushboo]

Sorry for the confusion.
Yes, I'm  looking for 1 hour values, then 4 and 24 hour running totals over the last week. 
i want count by page. Whenever i'm adding stats count by page with timecharts it returns no data.

[bowesmana]

Not sure what you mean by 'stats count by page with timecharts..'

Assuming you have a field 'page' then this timechart followed by the streamstats will give you all the relevant totals, but depending on how many pages you have, there will be a lot of data to visualise - with 4 values, each with significantly different scales that can only be represented on 2 y-axes.

your search
| timechart limit=0 span=1h count by page
| streamstats time_window=4h sum(*) as T_H04_*
| streamstats time_window=24h sum(*) as T_H24_*
| streamstats time_window=1w sum(*) as T_Wk_*
| fields _time T_*
| rename T_* as *

does that work?

[bowesmana]

It's not clear what your line graph is intended to show, just 4 values with 1,4,24 hours and 1 week totals?

Or are you looking for 1 hour values, then 4 and 24 hour running totals over the last week, e.g. like this

index=_internal 
| timechart span=1h count
| streamstats time_window=4h sum(count) as Hour4
| streamstats time_window=24h sum(count) as Hour24

but showing that as a line graph with 4 lines on isn't great on the same Y axis

You could do this to get the 4 values 

index=_internal earliest=-7d@d latest=@h
| timechart span=1h count
| streamstats time_window=4h sum(count) as Hour4
| streamstats time_window=24h sum(count) as Hour24
| streamstats time_window=1w sum(count) as Week
| reverse
| head 1
| eval Periods="Results"
| table Periods count Hour4 Hour24 Week

and show that as a column chart, or remove the 'Periods' value and show the results as single values in trellis mode.