i want to compare event count today with yesterday,last week and prior week using timewarp complete day like day starting to till now
Will these work?
... | bin span=1d _time | stats count by _time
And same search but 1w instead of 1d (for weeks instead of days)
hi @jkat54 thnaks for your answer but I want to compare the today event count with yesterday , last and prior week event counts like in the form of line chart like 4 legends.
Yeah, so you do the search above and select the weeks/days you want to chart with your time picker.
can you provide a sample full search for this??