how about:
index=_internal earliest=-14d date_wday="tuesday"
| eval day=date_month." ".date_mday
| stats count by day
by putting the filtering for date_wday in the initial search, you won't retrieve any extraneous events
Give this a try (check the rex messages)
index=d " earliest=-14d date_wday=Tuesday
| eval day=if(_time>relative_time(now(),"-7d"),"ThisWeek","LastWeek")
| rex field=EWS_MESSAGE_QUALIFIER "(?\w+)" | rex field=ews_transaction_log.ews_message_qualifier "(?\w+)"
| chart count by MESSAGE_TYPE,day
If date_wday is not already present
index=d " earliest=-14d@d | where strftime(_time,"%a")="Tue" | eval day=if(_time>relative_time(now(),"-7d"),"ThisWeek","LastWeek")
| rex field=EWS_MESSAGE_QUALIFIER "(?\w+)" | rex field=ews_transaction_log.ews_message_qualifier "(?\w+)"
| chart count by MESSAGE_TYPE,day
It worked thanks a lot,but please explain me
what will this below search does
eval day=if(_time>relative_time(now(),"-7d")
This is differentiating between two Tuesday that you'll get in the results. If the timestamp of the events is within last 7 days they are from the Tuesday just passed. If you run the query on or after Wednesday it'll give Tuesday of current week else it will give Tuesday of last week.
You need the timewrap
app:
how about:
index=_internal earliest=-14d date_wday="tuesday"
| eval day=date_month." ".date_mday
| stats count by day
by putting the filtering for date_wday in the initial search, you won't retrieve any extraneous events
Thank You arobbins ,It worked with just a small change in my query