I have made some progress and this is where I am at.
index=anIndex sourcetype=aSourceType aString earliest=-481m latest=-1m
| eval aWindow = case ( (_time > relative_time(now(),"-241m@m") AND (_tim...
See more...
I have made some progress and this is where I am at.
index=anIndex sourcetype=aSourceType aString earliest=-481m latest=-1m
| eval aWindow = case ( (_time > relative_time(now(),"-241m@m") AND (_time < relative_time(now(),"-1m@m"))),1,
(_time > relative_time(now(),"-246m@m") AND (_time < relative_time(now(),"-6m@m"))),2,
(_time > relative_time(now(),"-251m@m") AND (_time < relative_time(now(),"-11m@m"))),3,
(_time > relative_time(now(),"-271m@m") AND (_time < relative_time(now(),"-31m@m"))),4,
(_time > relative_time(now(),"-301m@m") AND (_time < relative_time(now(),"-61m@m"))),5,
(_time > relative_time(now(),"-331m@m") AND (_time < relative_time(now(),"-91m@m"))),6,
(_time > relative_time(now(),"-361m@m") AND (_time < relative_time(now(),"-121m@m"))),7,
(_time > relative_time(now(),"-481m@m") AND (_time < relative_time(now(),"-241m@m"))),8,
true(),9)
| stats count by aWindow
but I have realized that using a case statement allows each log event to exist in one window, when the windows overlap and one log event can exist in more than one window ? I am working on a dashboard for 8 widgets that currently do the exact same query, just a different window. So I am trying to make one query that has all data for the calculation, then in the widget(s) previously mentioned use $query.1$ to retrieve the result from the base reusable query.
So, how to I handle counting in these overlapping windows ?