Query:
index=apl-app-grap sourcetype=grap:apps source=*applications* host=xxxxxx
|rex field =_raw "\|rank\:(?<Report>.*?)\|"
|eval Pass=if(Report="0", "Pass", null())
|stats count(Pass) as Passed_Count
output:
Passed_Count |
700 |
But i need the output for day wise, suppose if i select 7 days i should get 7 rows (showing each day count) like shown below:
Passed_Count |
100 |
100 |
100 |
100 |
100 |
100 |
100 |
index=apl-app-grap sourcetype=grap:apps source=*applications* host=xxxxxx
|rex field =_raw "\|rank\:(?<Report>.*?)\|"
|eval Pass=if(Report="0", "Pass", null())
|bin span=1d _time
|stats count(Pass) as Passed_Count by _time