Table 1:
START_TIME END_TIME
----------------------------------------
S1 E1
S2 E2
S3 E3
[eg. S1="11/8/2015:00:00:00"
, E1="13/9/2015:13:00:00"
]
The search must be started by loadjob
:
| loadjob savedsearch="XXXXXX" .........
What I want to do is to use the "Table 1" to search by "_time" between S1 & E1 OR between S2 & E2 OR between S3 & E3.
And then do the stats count per time range in "Table 1".
i.e. Result table:
TimeRange Count
----------------------------
S1 to E1 100
S2 to E2 32
S3 to E3 33
Thanks in advance~~~!!!!
Try something like this
index=foo sourcetype=bar [| loadjob savedsearch="XXXXXX" | table START_TIME END_TIME | convert mktime(*) timeformat="%d/%m/%Y:%H:%M:%S" | rename START_TIME as earliest END_TIME as latest ] | ...rest of the search
But I also want to do the stats count per time range in "Table 1".
i.e. Sample Result table:
S1 to E1 100
S2 to E2 32
S3 to E3 33
Thanks.