I am ingesting advanced hunting logs and I have a main dashboard where I present the number of events per Event Category as single numbers. I want to be able to track the changes in the number of events.
For instance, if Monday has 1,000,000 events but Tuesday has 2,000,000 events then the number of events has increased by 1,000,000.
How can I work out the difference and display this on the main dashboard.
Any help is greatly appreciated
In that case you don't need to calculate the difference, just set the trend indicator for the single
Although you do still need to count over time
index=advanced_hunting
| bin _time span=1d
| chart count by _time EventCategory
index=advanced_hunting EventCategory=AdvancedHunting-DeviceEvents
| streamstats window=2 current=f last(EventCategory) as previous_count
| eval change=EventCategory-previous_count
Thanks
OK I had assumed you already had the daily counts by EventCategory, but it appears not. Try something like this
index=advanced_hunting
| bin _time span=1d
| stats count by _time EventCategory
| streamstats window=2 current=f global=f last(count) as previous_count by EventCategory
| eval change=count-previous_count
In that case you don't need to calculate the difference, just set the trend indicator for the single
Although you do still need to count over time
index=advanced_hunting
| bin _time span=1d
| chart count by _time EventCategory
Use streamstats to get the previous days count and subtract it from each days count.
| streamstats window=2 current=f last(count) as previous_count
| eval change=count-previous_count
Perhaps this might help actually so currently I'm ingesting advanced hunting logs into an index=advanced_hunting and within that index there is EventCategory, which has different categories such as AdvancedHunting-DeviceEvents or AdvancedHunting-DeviceFileEvents. As well as other fields like Timestamp etc
In the main dashboard, I've got a count of each of the EventCategory's which gives me the total number of events in each EventCategory, and I need to find a way to get the difference on a daily basis
What search do you already have? Perhaps we can build from there?