How to count a sum of events since a specified time?

[ssackrider]

How to count how many events are over 1 yr old? And better yet, how to show a pie chart comparing against the entire list?

[javiergn · Accepted solution]

I'm sure there will be other ways to achieve the same. Anyway, try this:

| metasearch index=foo sourcetype=bar
| eval year = relative_time(now(), "-1y")
| eval age = if(_time < year, "old", "new")
| stats count by age

Then go to the visualization tab and select Pie.

[ssackrider]

Wow-- Never thought of metasearch OR starting with a pipe.. but it works.. Thanks!