Hi @indeed_2000,
please try this:
your_search
| bin span=1h _time
| stats count(eval(status="ok")) AS OK count(eval(status="nok")) AS NOK by target _time
Ciao.
Giuseppe
Hi @indeed_2000,
please try this:
your_search
| bin span=1h _time
| stats count(eval(status="ok")) AS OK count(eval(status="nok")) AS NOK by target _time
Ciao.
Giuseppe
| timechart count by target
This should give you counts for each target against each time value.
When visualised, the timeline will be the x-axis, and you should have a line (for line chart) or column (for column chart) etc. for each series (target)
If you want, you can select one or more of these series as an overlay line on a column chart.