my search | stats count(eval(Code="3011648")) as "Incorrect login code" I am counting incorrect login code from this I want to divide count by week Monday Tuesday Wednesday Thursday Friday Saturday and Sunday in Realtime I want to count last seven days in a dashboard
Can some one help me please
Try this:
your search
|bin _time span=1d
| stats count(eval(like(Code, "3011648"))) as Incorrect_Login by _time
I would avoid real time searches
Try this.
my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
Thanks for the Response Its working But days are not coming in an order I want it in an order like Monday Tuesday Wednesday ------- sunday
So sort them.
my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
| eval sorter = case(date_wday="Monday",1, date_wday="Tuesday",2, date_wday="Wednesday",3, date_wday="Thursday",4, date_wday="Friday",5, date_wday="Saturday",6, date_wday="Sunday",7)
| sort sorter | fields - sorter
Not working