How to create a report to show an event occurring in the last minute, last 10 minutes, and since midnight?

[akhasriya]

I am looking to produce a report to show an event occurring in the last minute, last 10 minutes and since midnight:
eg:
event in the last minute 10
event in the last 10 minutes 32
event daily 1105

[somesoni2 · Accepted solution]

Try like this (update the first line of search per your's, keep the same earliest and latest)

index=foo sourcetype=bar earliest=@d latest=@m
| eval period=case(_time>=relative_time(now(),"-1m@m"), "event in last minute",_time>=relative_time(now(),"-10m@m"), "event in last 10 minute",true(), "event daily")
| stats count by period

[akhasriya]

Works great, thank you.