Hi all
I was wondering if i can get some help in this. as I have some fields in stats and i want span=1w of that.
when I use ....|timechart sapn=1w give me different values than in stats.
I juss want those stats values to be shown by week.
thanks
For binning stats, do this
|bucket span=1w _time
|stats your_aggregations by _time, your_grouping_fields
you can add a 1 week span to your stats like this
| bucket _time span=1w
and then add _time
to the by callMediaType
for your stats command.
also, your stats has a by callMediaType
but you did not include that in your timechart. This in and of itself would make the results different. Is that on purpose?