| tstats count as w_count where index=your_index TERM("error") by _time
| eval date_wday=strftime(_time,"%w")
| where date_wday = 1
| stats avg(w_count)
It is fast if error is correct.
The number that contains the strings of error in the log is counted.
... View more