Timechart trend

[gcusello]

I have to show trends in one search: I'd like to have the results of last 24 hours and to compare it with the result of the previous 24 hours.
To do this I used timechart span 24 hours and timerange 48 hours: ...| timechart span=1d count | reverse .
But results are showed by day:
2015-04-03 547
2015-04-02 1032
2015-04-01 621
instead I'd like to have a result like the following:
1384
1259
to show the real trend over 24 hours of the results.

How can I di this?
Thank you.
Bye.
Giuseppe

[gcusello · Accepted solution]

after almost five years I found my answer:

index=wineventlog earliest=-48h
| eval _time=if(_time>relative_time(now(), "-24h"),now(),relative_time(now(), "-24h"))
| timechart span=24h count

Ciao.
Giuseppe

[vnguyen46]

Interesting, but it goes back only 48 hours. How to make it 7 days or with a time picker?
My search is:
index=wineventlog earliest=-48h
| eval _time=if(_time>relative_time(now(), "-24h"),now(),relative_time(now(), "-24h"))
| timechart span=24h count by login_status

Thanks,

[stephanefotso]

Take a look at this : index=_internal sourcetype=*| bucket span=24h _time| eval day_month=strftime(_time, "%d/%b")|chart count by day_month

[gcusello]

I have to show the trend over a 24 hours period comparing the occurrences in the last 24 hours with the ones in the 24 hours before, starting from the actual time: so if I start my search at 11 A.M. of the 5th of april, I need to have the result in two periods:
from 2015-04-04 11.00.00 to 2015-04-05 10.59.59
from 2015-04-03 11.00.00 to 2015-04-04 10.59.59

instead timechart divides results only by days
2015-04-05 547
2015-04-04 1032
2015-04-03 621
but probably it isn't possible.

Thank you.
Giuseppe

[surekhasplunk]

hi @gcusello,

I have the same query where i have to show the trend for last 24hrs which is working fine but the count of alerts is coming as of now or today not for last 24hrs . can you please help if you have got any solution .

Here is my query which i am using currently.

myquery | lookup abc.csv Device output Type | where isnotnull(Type) | timechart span=1d count(Status) as Total | trendline sma2(Total) as Trend

[ppablo]

Hi @cusello

Have you tried changing the span to span=24h instead?

[gcusello]

yes I tried both with span=1d and span=24h (I know that it's the same thing!)
The problem is that timechart divides always results by day, instead I'd like to have a division by span period, but probably it isn't possible.
Thank you.
Giuseppe