I cannot get that query to work w/ timechart command. I prefer to use stats command. I am still not understanding how to compare data to previous hour. I have this query which is similar to original post. index=XYZ |stats count(_raw) as Total, count(eval(txnStatus=="ok")) as Success, count(eval(txnStatus=="cc_fail")) as "Failed" |eval Comp_Percentage= (Success/Total * 100)|eval Comp_Percentage=round(Comp_Percentage,2) How do I add a count to that query where I am looking at previous day at the same hour? Thanks for any guidance you can provide. ... View more

Try this: ... | rex "(?<request>\d+)[\r\n\s]*$" ... View more