How to create a stats/table with day by day search?

[tpaulsen]

We are running every night a scheduled search:

sourcetype="statistik" (FZ!=0 AND AZ!=0) | stats sum(FZ) sum(AZ) by FNR,FKZ | sort FNR

The output looks like this:

FNR        FKZ          sum(FZ)          sum(AZ)
358        4            23523            233
359        00           2                42525

The data is collected out of a file that is also created once a day and has only one timestamp per day.

We would like to create now a weekly report, that includes as colons all 7 days. Like this:

FNR        FKZ          sum(FZ)d1        sum(AZ)d1          sum(FZ)d2         sum(AZ)d2
358        4            23523            233                3454              5
359        00           2                42525              34                1233

How can we achieve this?

[dineshraj9]

This will give you daywise statistics -

sourcetype="statistik" (FZ!=0 AND AZ!=0) | bin span=1d _time | eval DAY=strftime(_time,"%Y-%m-%d") | stats sum(FZ) sum(AZ) by DAY

[woodcock]

Try this:

sourcetype="statistik" (FZ!=0 AND AZ!=0) | timechart span=1d sum(FZ) sum(AZ) by FNR,FKZ