i have to display count of hosnames, that have last_seen >30 days, in first day of week: for 08.07.19 count number of hostnames that have last_seen >30 days for 01.07.19 count number of hostnames that have last_seen >30 days for 24.06.19 count number of hostnames that have last_seen >30 days for 17.06.19 count number of hostnames that have last_seen >30 days the output will be: week1 count week2 count week3 count week4 count all this i need to do in one search ... View more

index=en_amp_api earliest=@w1 latest=@w2 | eval description1=case(last_seen<strftime(relative_time(_time,"-4w"),"%Y-%m-%dT%H:%M:%SZ"),"week1") | eval description2=case(last_seen<strftime(relative_time(_time,"-4w"),"%Y-%m-%dT%H:%M:%SZ"),"week2") | eval description3=case(last_seen<strftime(relative_time(_time,"-4w"),"%Y-%m-%dT%H:%M:%SZ"),"week3") | eval description4=case(last_seen<strftime(relative_time(_time,"-4w"),"%Y-%m-%dT%H:%M:%SZ"),"week4") | stats count(description1) as week1,count(description2) as week2,count(description3) as week3,count(description4) as week4 this is my code and i would like to modify earliest and latest for each case ... View more