Hi how should I modify my search to make it work?
host="javaserver1" source="/var/log/javastuff.log" earliest=-1d@d latest=-0d@d Sending failed | multikv | eval ReportKey="yesterday" | append [search host="javaserver1" source="/var/log/javastuff.log" earliest=-0d@d latest=now Sending failed | multikv | eval ReportKey="today"] |timechart span="1h" count by ReportKey
While today's results are displayed, yesterday's results are zero for every hour, then when yesterday's results begin displaying other values than zero, today's results are displayed all as zeroes.
Any solution to this?
The append command adds today's results as separate events following yesterday's. Then timechart sums the events based on _time, so the two series will not overlap. Try this instead
Notice that this is the same as your original search BUT I added one day to the timestamp. This forces the data from yesterday to plot over the same time period as the data from today.
The other solution should be faster in most cases, but this will be more flexible when you really want to use a timechart.
answered 08 May '12, 13:42