| stats count by field1 field1 field2 field3 only show yesterday count, how can I show count1 for yesterday, count2 for 2-day ago, count3 for 3-day ago,
shown as following
field1 field2 field3 count1 count2 coun3
| bin _time span=1d | stats count by _time field1 field2 field3 | eventstats values(_time) as dates | eval day=mvfind(dates, _time)+1 | eval count{day} = count | fields - count dates day _time | stats values(*) as * by field1 field2 field3
View solution in original post
它有效. thanks
your search | bin _time span=1d | stats count by _time field1 field2 field3
also you will need your time range window to cover the time range you are interested in
The timechart command may also be useful
Could timechart multiple fields and time window in column?
No timechart is only a single split field, but I mentioned it in case it was relevant.
The stats command with _time and the bin command should do the trick for you.
