I wonder if it is possible to compute average number of events over the days of the weeks, i.e. Monday, Tuesday... for the whole month. The following code will compute over dates of the month, which I don't want. I want to look weekly pattern in my data.
source="xxxx" | stats count by date_mday
Not sure if this is what you want, but you can surely do something along the line of;
source=xxx | eval zzz = date_wday . "-" . date_mday | stats count by zzz
You can run this search with the "Month to date" timepicker option, with the following result;
zzz count Monday-13 453 Thursday-6 431 Tuesday-21 419 Sunday-8 398 ...
use eval strftime.
Yeah it wasn't a correction, just a heads up for mrigendras - I know I'm not alone in having assumed all events have those fields 🙂
That is true. But since mrigendras question mentions the use of date_mday, it can be assumed that the date_* fields are available in this case.
Just beware that the
date_* fields do NOT necessarily exist in all events. For instance events retrieved from Windows event logs do not have them.