Below is my query:
_sourceHost=api AND _sourcename = "/opt/dwelo/logs/cloud_api.access.log" | timeslice 1d | count_distinct(minion_id) by minion_id, _timeslice | count_distinct(_timeslice) as days_online by minion_id | round(days_online / 8 * 100) as online_percentage | fields minion_id, online_percentage | limit 10
If the user selects the time range as 3 days instead of a week (as my query assumes), how can I dynamically change the 8 I have embedded in the above query? Is there some special variable available that tells you the range of the query?
Please sign in to leave a comment.