How do I select a time frame for events?

[lmzheng]

For the following search, I want to display the earliest and latest events within a duration of a year. However, I want the Error Counts to be displayed with a duration of only a week. I read about spans, but it doesn't seem to be producing the results I want.

| search EventType=Errors
| eval ErrorMessage=Server+": "+Application+": " +ErrorMessage
| stats earliest(_time) as Earliest, latest(_time) as Latest, count as "Error Count" by ErrorMessage
| convert ctime(Earliest), ctime(Latest)
| sort - "Error Count"
| head 10

Thank you!
Lee

[solarboyz1]

Use use the eval command in stats to get a count of the events whose timestamp are occur within the last week:

| search EventType=Errors earliest=-1y
| eval ErrorMessage=Server+": "+Application+": " +ErrorMessage
| stats earliest(_time) as Earliest, latest(_time) as Latest, count as "Error Count YTD", count(eval(_time>(now()-604800))) as "Error Count WTD" by ErrorMessage
| convert ctime(Earliest), ctime(Latest)
| sort - "Error Count WTD"
| head 10