I'm trying to count all my data by each day of the week each time a host is hit.
EX: machine a has a script run once Monday, and Tuesday and three times on Wednesday. I just wanna track how many times a week it's hit per week. I know I can bucket _time but can't get the count function to properly display the info.
index=x sourcetype=x host=*
| bucket _time span=day
| count by host by day