Yannk,
I did this way:
index="prod" earliest=@d latest=-5s
| eval Hora=strftime(_time,"%H")
| stats sum(corrente) as tday by Hora
| appendcols
[ search index="prod" earliest=-1d@d latest=@d
| eval Hora=strftime(_time,"%H")
| stats sum(corrente) as yday by Hora]
| appendcols
[ search index="prod" earliest=-7d@d latest=-6d@d
| eval Hora=strftime(_time,"%H")
| stats sum(corrente) as lweek by Hora]
| accum tday as today
| accum yday as yesterday
| accum lweek as last_week
| table Hora, _span, today, yesterday,last_week
... View more