I have a search where I'd like to go back 1 week and then search the same time on each day during that week and return results.
So far I have been looking at all of the time range modifiers and still haven't come up with exactly what I am looking for.
My search is:
sourcetype="Cron_SendNotificationEmail" OR sourcetype="Cron_CheckRegistrarThreshold" (source="*asia*" OR source="*info*" OR source="*org*" OR source="*mobi*" OR source="*me*" OR source="*aero*" OR source="*cctld*") earliest=-1d@d latest=-1d@d+23h+55m | rex field=_raw "send_to_email ?\[(?P<send_to_email>\S+)\]" | rex "(?P<inserting_a_record>Inserting a record.*)" | search inserting_a_record="*" OR send_to_email="*" | timechart count(inserting_a_record) as TotalEmailsToSend count(send_to_email) as TotalEmailsSent`
obviously i don't have the right time modifiers in the search right now, but i'm trying to figure it out. so far i think i could start with "startdaysago=7" but after that I'm not sure how to tell the search to search on every day after going back 7 days at the times I would like which is:
00:00 to 23:55
I think I have an idea of where you're trying to go. Do you think you could add a table of what you'd like the tabular output of the search to be? ie what are the rows and columns you want to end up with?
If I get you right you'd like to dismiss events being generated the last five minutes before midnight every day. Would something like this do?
.... earliest=-7d@d NOT (day_hour=23 AND day_minute>=55)
I am still messing with this query, but I don't want it to include any results from the current day at all. I only want the last 7 days NOT including the present day.
sourcetype="Cron_CheckRegistrarThreshold" (source="asia" OR source="info" OR source="org" OR source="mobi" OR source="me" OR source="aero" OR source="cctld") earliest=-7d@d NOT (day_hour=23 AND day_minute>=55) | rex "(?P
well this probably would work, but now the problem appears to be that the query isn't giving me the results i would expect. It should pull out two fields, TotalEmailSent and TotalEmailsToSend and once charted both of these numbers should match. For some reason they aren't.