Hello,
I want to compare event counts for indexes to evaluate if there is unexpected changes in logging. In order to react in time I want those counts to be summed up from start of day until now() for each day of the last seven days, so I can directly see which amount I would expect for each day until e.g. 2pm.
The tricky part for me is, how to sum those event counts for the days before today (up until the current time, but for e.g. yesterday). I managed to get some results showing the counts for each day until now() for each day. But i have no clue how to sum them per day.
Search:
|tstats prestats=t count WHERE index=<example> by _time span=1h
| eval now=tonumber(strftime(now(),"%H"))
| eval hour=strftime(_time, "%H")
| where hour<=now
| timechart span=1h count
|table _time count
Result:
The result makes me pretty hapy already, but the step to get a sum out of those counts per day somehow eludes me.
many thanks for a hint in the right direction.
