The problem with the above is that it replaces the 2 days with 0s. Therefore, if you pipe the search into |predict, it skewers the results.. I want those 2 days totally removed from the equation.
Here is my search:
index="MSExchange" sourcetype="MSExchange:2010:MessageTracking" eventtype="storedriver-deliver" (date_wday=monday OR date_wday=tuesday OR date_wday=wednesday OR date_wday=thursday OR date_wday=friday) | timechart count as NoofMessages | predict NoofMessages future_timespan=180
In the above example for your search data you get Fri 1000, Sat 0, Sunday 0, Tues 2500... the 0s
... View more