How to count how many events are over 1 yr old? And better yet, how to show a pie chart comparing against the entire list?
I'm sure there will be other ways to achieve the same. Anyway, try this:
| metasearch index=foo sourcetype=bar
| eval year = relative_time(now(), "-1y")
| eval age = if(_time < year, "old", "new")
| stats count by age
Then go to the visualization tab and select Pie.
View solution in original post
Wow-- Never thought of metasearch OR starting with a pipe.. but it works.. Thanks!