event count for a device for a day
We have integrated firewalls, we need to count denied events for day, and run the report for week.
Expected output: 7 days count per day.
Question: how to set the time from 00:00 hrs to 23:59hrs in a query.
-
Official comment
Hi Deepak,
You would want to use the timeslice operator and count by that field for something like this.
For example:
[YOUR SEARCH SCOPE]
| timeslice 1d
| count by _timesliceRun this query for the last 7 days.
Thanks,
Nick
Sumo Logic, Customer SuccessComment actions -
Adding on to Nick's tip...
You can't specify the time range in the query syntax, you instead use the time range selector at the top right.
BTW, you can manually enter time ranges like:
-24h (when you only provide one time expression, "to Now" is assumed.
-3d to -2d
13:15 to 13:45
You can one or two relative times, OR one or two static times. (You can't combine static and relative.)
Please sign in to leave a comment.
Comments
2 comments