Hi, I'm trying to plot graph for previous 2 weekday average. Below is the query used
index="xyz" sourcetype="abc" app_name="123" or "456" earliest=-15d@d latest=now | rex field=msg "\"[^\"]*\"\s(?<status>\d+)"
| eval HTTP_STATUS_CODE=case(like(status, "2__"),"2xx")
| eval current_day = strftime(now(), "%A")
| eval log_day = strftime(_time, "%A")
| where current_day == log_day
| eval hour=strftime(_time, "%H")
| eval day=strftime(_time, "%d")
| stats count by hour day HTTP_STATUS_CODE
| chart avg(count) as average by hour HTTP_STATUS_CODE
This plots grpah for complete 24hrs.
I wanted to know if I can limit the graph to current timestamp. Say now system time is 11AM. I want graph to be plotted only upto 11AM and not entire 24hrs. Can it be done ? Please advice
Just to be clear, you are thinking of previous 2-week average by hour of day, not previous 2 weekday average. Correct?
index="xyz" sourcetype="abc" app_name="123" or "456" earliest=-15d@d latest=now | rex field=msg "\"[^\"]*\"\s(?<status>\d+)"
| eval current_day = strftime(now(), "%A")
| eval log_day = strftime(_time, "%A")
```| where current_day == log_day```
| eval hour=strftime(_time, "%H")
| eval current_hour = strftime(now(), "%H")
| where hour <= current_hour
| eval day=strftime(_time, "%d")
| stats count by hour day HTTP_STATUS_CODE
| chart avg(count) as average by hour HTTP_STATUS_CODE
Note you cannot have | where current_day == log_day and still get average across multiple days.
@yuanliu I'm looking for previous 2 "weekday" average.
Consider, today is "Wednesday". I want to plot avg of previous 2 Wednesday's as a comparison against live data.
Along with this, how can the search be only limited to the time range selected from the time picker ?