I want to create a dashboard that shows 2 things.  First, it will search over the last 60 minutes for total errors.  sourcetype=blabla  error And, it will look for average errors for the same time period over the past month.  For example, if the search is ran at 14:29, it will show the average errors for 13:30-14:29 for each day over the last month, preferably just weekdays.   So, it will show a stats table with two results.  Total errors for the last 60 minutes, and average errors over that time period for the last month.   Thanks ... View more

I'm wanting to create a visualization that shows the average amount of errors during each minute of the day over a period of time. I can do it for each hour of the day: index=ind sourcetype=sotp "error" | bin _time span=1h | eval date_hour=strftime(_time, "%H") | stats count AS hits first(date_hour) AS date_hour BY _time | stats median(hits) BY date_hour I can also do it for minute of the hour, but not minute of the day. It would be nice to have more granularity. Thanks ... View more