Hi ,
i am using this query to get the daily transaction for every hour for a day.
sourcetype="*Leg324.log" tid|rex field=_raw "\stid((?
in X axis i am getting avg(transaction_per_hour) ,can anybody help me to get transaction_per_hour instead of the earlier one .
Use this
sourcetype="*Leg324.log" tid|rex field=_raw "stid((?<tid>d+)"|dedup tid |eval status = if(transaction == 200, "OK", "Error")|stats count(tid) AS transaction_per_hour BY date_hour, date_mday | chart avg(transaction_per_hour) as transaction_per_hour By date_hour