I have log where some different events (event A, event B, event C...) are expected to be generated periodically .
Now I want to calculate number of appearances of each event per_hour and identify, what of events did not appear in this particular time chunks and create report.
time event count 2016-08-31 22:00;00 event_A 0 2016-08-31 22:00;00 event_B 1 2016-08-31 22:00;00 event_C 3 2016-08-31 23:00;00 event_A 2 ...
What I've tried:
| bucket _time span=1h | stats count by event _time | sort event by _time
This do not return zero values of count (e.g. time: "2016-08-31 22:00:00" event: "event_A" count: 0)
timechart span=1h count by event helps only to visually identify my zero points, but I need an inline table view,
stats latest(_time) by event | eval diff=now()-latest ... not an option as this is required for historical data.
Do I miss something? How can I get result alike presented above?