We would like to count the number of error events in 15 minute intervals and show that number as the number of errors per minute for the previous 15 minutes. How would I do that using the timechart command?
Sample search: index=main loglevel=error earliest=-15m | timechart span=15m
What would the rest be?
See if this gives you what you're looking for
index=_internal error | timechart span=15m count | eval min=count/15
OR
index=_internal error earliest=-15m@m | timechart span=1m count