Display total and type from one type in Area Plot 24hr increments

[CharterBT]

Hope someone is up for a challenge. Here's the query I'm using.

index=[app] [keyword] earliest=10/01/2013:0:0:0 latest=11/01/2013:0:0:0 | fillnull value=NULL cs5 | stats count by src, cs1, cs5 | eval cs5 = case(cs5="NULL","No MSRT Fix",1=1,"MSRT Fix Available")

My results table lists each unique instance (where src=IP address and cs1 lists the infection's name and cs5 determines if MSRT can fix it or not.

I would like to design a 3-level area plot for my dashboard that displays the total # of events, total # with no fix, and total # fixable, and I'd like the total count to start over every 24 hours, thereby counting each IP with a unique infection to only be counted once per day.

I can't get the area plot to include the total events found (fixable and not), I can't get it to break up its peaks by day, and I can't get it to treat each day as a unique set of results. I don't know if I should use dedup because I want the IP-with-unique-infection to be counted again if it appears again on another day.

Is all this even possible? I'm really having a hard time with this, so any help is greatly appreciated. Thanks in advance.

[jtrucks]

First, if you want this to be a single day count, you can do earliest=-0d@d latest=now to count from midnight last night until now. If you want this to be a rolling 24hr count, then you do earliest=-24h@h latest=now and it will calculate 24 hours back anytime you run the search.

Next to tackle the count totals, look into eventstats instead of stats. You'll have to experiment some and look at what eventstats gives you for totals, and dedup on src prior to the count. I don't have the data to try this on, but perhaps something like this:

index=[app] [keyword] earliest=-24h@h latest=now | dedup src | fillnull value=NULL cs5 | eventstats count by src, cs1, cs5 | eval cs5 = case(cs5="NULL","No MSRT Fix",1=1,"MSRT Fix Available")