How to create a search to show a trending single value for the last 60 minutes of data with a trending arrow comparing the previous 60 minutes?

[mattusr]

Hi,

Sorry if this has been answered before, however, I am struggling with a search that I am trying to build.

The ideal result that I am trying to achieve is the following.

I wanted to create a search that could be used as a single value element with a trending arrow. So currently I am doing the following search

index=main machine_ip="xx.xx.xx.xx" http_status=200 | dedup user_ip | timechart span=60m count

However, this searches the last hour (if only 5 minutes into the hour the current hour will only have 5 minutes of data and therefore always be playing catch up to the previous hour).

Therefore I want to change this so it shows the continuous last 60 minutes. So if the search is run at 15.05 the single value would show 14:05 to 15:05 and the trend arrow and value with compare 13:05 to 14:05.

Please let me know if you require any further information.

[hylam · Accepted solution]

index=_internal | timechart span=1m count | eval _time=_time-now()%3600 | timechart span=1h sum(count) as count | tail 3 | tail 2 | eval _time=_time+now()%3600

EDIT1
Dont forget to select "last 120 minutes" on the time picker

[mattusr]

Brilliant that works!! If it not too much trouble is there any chance you could provide a brief explanation of the search? Thank you!