1. Logpoint Service Desk
  2. Community
  3. SIEM - Searching & Analytics

how to compare different times in search

Avatar
Follow
0

Dear fellow LogPoint users,

I am wondering if there is the possibility to compare the results of a querry for different times in one plot?

This would be very helpful to identify regularities/irregularities. For example, the number of logs received today over the number of logs received yesterday and the day before. Yes, I can create a dashbord and stack the corresponding widgets on top one another. However, it would be helpful to be able to directly compare the curves in one plot.

Thanks in advance

Georg

Share This Post:

2 comments

Date Votes
0
Avatar
Sagar Bhandari

Hello Georg,


Unfortunately, it is not currently possible to directly compare the results of the same query for different time slots within a single search. However, for your specific use case, you can utilize the following query: "|timechart count() by repo_name every 1 day" with the desired time range. This will allow you to view and compare the number of logs you are receiving for a particular repository each day. I recommend avoiding the selection of a large time range encompassing all repositories at once, as it may impact the system's performance. To ensure optimal performance, you can run or create a widget using the provided query, selecting a specific repository for analysis.

Selecting only one repo
Selecting two repos(Selecting multiple repo and huge time range might degrade the performance)




Best Regards,

Please sign in to leave a comment.