Group similar Windows event IDs together with respect to time

[amir_thales]

Hello,

After several searches, I did not find the way to group my event ID together in relation to time.

That is, I want for each Id event to display the number of "count" on a week. Place the Event IDs horizontally and vertically the time (1 week) and for each crossing we have the total count of each eventID

Thank you
Amir

[woodcock · Accepted solution]

Like this:

Your Base Search Here
| bin _time span=1w@w0
| chart count OVER _time BY EventID

[amir_thales]

Hello @woodcock,

Thank you for you response.

Amir