index=abc
| stats latest(_time) AS Last_time by day
| convert ctime(Last_time)
| sort by Last_time desc
for example,
Monday | 06/13/2022 13:03:11 |
Tuesday | 06/13/2022 13:03:11 |
Wednesday | 06/13/2022 13:03:11 |
Thursday | 06/13/2022 13:03:11 |
Friday | 06/12/2022 13:03:11 |
Saturday | 06/13/2022 13:03:11 |
Sunday | 06/13/2022 13:03:11 |
I want the search to return 0 // or something else if there was no event today.
Monday | 06/13/2022 13:03:11 |
Tuesday | 06/13/2022 13:03:11 |
Wednesday | 06/13/2022 13:03:11 |
Thursday | 06/13/2022 13:03:11 |
Friday | 0 // or something else |
Saturday | 06/13/2022 13:03:11 |
Sunday | 06/13/2022 13:03:11 |
Is that possible.
timechart will fill in the blanks in the time line - try something like this
| timechart latest(_time) as latest_time
| fillnull value=0