I am attempting to work out the frequency of events over the selected timespan in weeks. Basically: count of events in current timespan divided by weeks in timespan.
I can get a count of events for the selected timespan using:
index=mydata
| stats count(eval(ishotfix= "false")) as hfx
| fields hfx
I can get the timepicker span weeks using (im sure this is terrible):
| makeresults
| addinfo
| eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| fields timepickerSpanWeeks
and if I combine I am getting no results
| makeresults
| addinfo
| eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| map search="search index=mydata"
| stats count(eval(ishotfix= "false")) as hfx
| eval rate=round((hfx/timepickerSpanWeeks), 2)
| fields rate
thanks in advance!
index=mydata
| addinfo | eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| where ishotfix= "false"
| eventstats count(timepickerSpanWeeks) as counter
| eval rate = round(counter / timepickerSpanWeeks,2)
| top rate
| fields rate
This is what got me the result, it seems like a poor way of getting it but the number of results isn't large. Happy for someone to revise! 🙂 Thanks for your help @ITWhisperer
Try this
index=mydata
| addinfo
| eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| stats count(eval(ishotfix= "false")) as hfx
| eval rate=round((hfx/timepickerSpanWeeks), 2)
index=mydata
| addinfo | eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| where ishotfix= "false"
| eventstats count(timepickerSpanWeeks) as counter
| eval rate = round(counter / timepickerSpanWeeks,2)
| top rate
| fields rate
This is what got me the result, it seems like a poor way of getting it but the number of results isn't large. Happy for someone to revise! 🙂 Thanks for your help @ITWhisperer