Assuming that you can be relatively certain that count is at least 1 for every minute of the day...
your base search
| eval Day=strftime(_time,"%Y-%m-%d")
| eval Minute=strftime(_time,"%H:%M:%S")
| stats count as minutecount by Minute Day
| eventstats max(Day) as Today
| eval Today=if(Day=Today,minutecount,null())
| eval Week=if(Day=Today,null(),minutecount)
| stats avg(*) as * by Minute
Assuming that you CANNOT be relatively certain that count is at least 1 for every minute of the day, here's one way to fill in the missing zeroes...
your base search
| eval Day=strftime(_time,"%Y-%m-%d")
| eval Minute=strftime(_time,"%H:%M:%S")
| stats count as minutecount by Minute Day
| append
[| makeresults
| eval Time=mvrange(relative_time(now(),"-6d@d"),relative_time(now(),"@d"),60)
| mvexpand Time
| eval Day=strftime(Time,"%Y-%m-%d")
| eval Minute=strftime(Time,"%H:%M:%S")
| table Day Minute
| eval minutecount=0
]
| stats sum(minutecount) as minutecount by Minute Day
| eventstats max(Day) as Today
| eval Today=if(Day=Today,minutecount,null())
| eval Week=if(Day=Today,null(),minutecount)
| stats avg(*) as * by Minute
... View more