I am trying get the max count for the yesterday's but along with this i need to display the date in the report for yesterdays date?
Kindly help me to get the date in the results along with the existing results.
Query: sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime | stats max(count)
Output for the above query is :
max(count)
34
Thanks In Advance
The stats
command filters out all fields except those explicitly named in the command so _time is not available. Depending on the time window of your search, this may fill your needs.
sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime
| stats max(count) as MaxCount
| eval Date = strftime(now(), "%F")
| table Date MaxCount
Try this,
sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime | eventstats max(count) as count | eval date=strftime(now()-86400, "%d-%m-%Y")
by this i am getting count for that interval. Actually i am looking for complete day Max count with the date incorporated in that.
what are logtime values?
Its like
logtime
for todays date and time --> the count will get displayed.
Like below
logtime count
2020-03-11 19:38:42 34
2020-03-11 17:30:53 29
2020-03-11 19:17:02 29
2020-03-11 17:17:36 28
ok, you can use stats in place of eventstats. And you wrote need to display the date in the report for yesterdays date. Replace now()-86400 with now() if you don't want yesterdays date.
sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime | stats max(count) as max_count | eval date=strftime(now()-86400, "%d-%m-%Y") | table date, max_count
Yeah, this is working as expected.
The stats
command filters out all fields except those explicitly named in the command so _time is not available. Depending on the time window of your search, this may fill your needs.
sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime
| stats max(count) as MaxCount
| eval Date = strftime(now(), "%F")
| table Date MaxCount
Perfect 🙂
so to get the date field this is the syntax " | eval Date = strftime(now(), "%F")" right ?
Right. That will get you the current date as a string. Modify the second argument to strftime
if you want the date in a different format.
By the above query i am getting the date filed in the results but its getting today's date, but the report is running for yesterday's data. So we need to display yesterday's date.