How to edit my search to create a dashboard that displays an event count per hour with weekly total?

[jtracy]

Hello, I have the following simple query;

index="myindex" source="*sourcelog.txt" "KEYWORD"

This search returns about 90,000 events over a given week with "KEYWORD" in it. How can I create a dashboard that shows me how many events per hour and day over that week, along with a running weekly total?

Thanks in advance for your help guys.

[sundareshr · Accepted solution]

Like this

index="myindex" source="*sourcelog.txt" "KEYWORD" earliest=-7d@d | timechart span=1h count | accum count

[jtracy]

This is close.

This shows a contiguous count spanning across 7 days. I would like an individual count per hour and then a summation of all counts per week. Is this possible?

[sundareshr]

Are you showing more than 1 week's worth of data?

[jtracy]

No, I am limiting the search to "Week To Date"

[sundareshr]

So what do you want for summation per week? Just the total for the entire week? Would that be total of count? Do you want the summation at the bottom or as an additional field? For summation at the bottom, add this to the end of the query

... | addcoltotals labelfield=_time label="Week Total"

If you want as an additional field, add this to the end

... | eval wknum=strftime(_time, "%U") | eventstats sum(count) as wk_total by wknum | fields - wknum