Dynamic query to get the result in specific timeframe for any days

[anirban_nag]

I have a specific timeframe say from 1AM to 2AM. In this 1 hour I want to see all the failures from my log. But I want to see this timeframe failures not for only today but for N no of days. This N will be specified from the Date Range dropdown.

Bouns point if I can get the result for each day in a column chart side by side.

[inventsekar · Accepted solution]

we can use date_hour and solve this specific timeframe issue.
Try this one -

 index=main sourcetype=yourSourcetype earliest=-31d latest=-1d (date_hour > 1 OR date_hour < 2) | chart count(Failure) by sourcetype over host