I am looking to produce a report to show an event occurring in the last minute, last 10 minutes and since midnight:
eg:
event in the last minute 10
event in the last 10 minutes 32
event daily 1105
Try like this (update the first line of search per your's, keep the same earliest and latest)
index=foo sourcetype=bar earliest=@d latest=@m
| eval period=case(_time>=relative_time(now(),"-1m@m"), "event in last minute",_time>=relative_time(now(),"-10m@m"), "event in last 10 minute",true(), "event daily")
| stats count by period
Try like this (update the first line of search per your's, keep the same earliest and latest)
index=foo sourcetype=bar earliest=@d latest=@m
| eval period=case(_time>=relative_time(now(),"-1m@m"), "event in last minute",_time>=relative_time(now(),"-10m@m"), "event in last 10 minute",true(), "event daily")
| stats count by period
Works great, thank you.