I would like to get event count for a particular time period for each day for a given date range (that I will select from search drop down). Time period is between 14:31 hrs and 15:01 hrs for each day.
I am using below query. So two questions: a) can this query be optimized for better performance and b) this query gives me statistics but graph in visualization display all the time and does not adhere to my choosen time window of between 14:31 hrs and 15:01 hrs
index=applogs_01 AND sourcetype=app_pmt
| eval Date=strftime(_time, "%m/%d/%Y")
| where (_time >= strptime(Date." "."14:59","%m/%d/%Y %H:%M") AND _time<=strptime(Date." "."15:01","%m/%d/%Y %H:%M"))
| bin span=1s _time
| stats count by _time
You can do some like this. It will then only give result between 14:31 (14*60+31=871) and 15:01 (901)
your search
| eval Time=date_minute+date_hour*60
| where Time>=871 AND Time<=901