I run index=hydra bu=dmg env="prod-*" ERROR
everyday and record the count. I lost the statistics I had kept and would like to get them back. Is there a query that can help me do this? The query should get me the count of running the above query as if run daily (24 hr span).
@manish41711 - yes, that query will get your the daily figures. So would the following
index=hydra bu=dmg env="prod-*" ERROR
| bin _time span=1d
| stats count as dailycount by _time
Will this query help ? index=hydra bu=dmg env="prod-*" ERROR earliest=-90d@d latest=@d | timechart span=1d count
@manish41711, This query gets you daily aggregated count of "ERROR" events for last 90 days. Is this what you want?