Hi @viktoriiants., How about something like this: index=_internal
| eval dayOfWeek=strftime(_time, "%A"), date=strftime(_time, "%Y-%m-%d")
| eval dayNum=tonumber(strftime(_time,"%w")) + 1 ``` 1=S...
See more...
Hi @viktoriiants., How about something like this: index=_internal
| eval dayOfWeek=strftime(_time, "%A"), date=strftime(_time, "%Y-%m-%d")
| eval dayNum=tonumber(strftime(_time,"%w")) + 1 ``` 1=Sunday, ..., 7=Saturday```
| stats count as "Session count" by dayOfWeek, date
| addtotals col=t row=f
| eval sort = if(isnull(date),1,0)
| sort - sort + date
| fields - sort Here we're creating a new temporary field to sort on, where we set it to 1 for our total row, and 0 for all other rows. Then we sort by this column and the date column. Finally, we remove the "sort" column.