Topic
  • 3 replies
  • Latest Post - ‏2012-11-28T18:59:26Z by SystemAdmin
SystemAdmin
SystemAdmin
184 Posts

Pinned topic Group by Date?

‏2011-10-07T21:37:12Z |
I need to run a long query and group by the date then count the sum of events for that day. This seems really simple in theory, except if I try to group by start/end date in the normal fashion, I get an error saying it can't be grouped this way. Ideas anyone? I'm gonna guess I'll need a customer parameter at this point, but wanted to be sure. -------Posted BY Karl
Updated on 2012-11-28T18:59:26Z at 2012-11-28T18:59:26Z by SystemAdmin
  • SystemAdmin
    SystemAdmin
    184 Posts

    Re: aggregate over "time"

    ‏2011-10-19T14:50:41Z  
    Hi Karl ..

    this is a feature I had thought about a while ago, actually, the ability to use time as an aggregate, perhaps on an minute, hour, day, etc, and then create a graph based on that.

    The FR for this is #23230, and I'll add you to this.

    In the meantime, if your data has date stamps (ie, in the syslog header), you may be able to grab the month+day string as a custom field, then aggregate on that custom field.

    dwight.
    Posted By dwight (q1)
  • SystemAdmin
    SystemAdmin
    184 Posts

    Re: Aggregate over time

    ‏2012-11-28T16:16:48Z  
    Is this feature request is solve ? We have 7.0 MR5 and I need to graph over time in a report. This feature in the log activity and in the dashboard is very useful to look for Pattern.
    Posted By G.Grondin
  • SystemAdmin
    SystemAdmin
    184 Posts

    Re: That is what I have done to get around this issue..

    ‏2012-11-28T18:59:26Z  
    I have always done as Dwight has recommended to get around that. You can group by a custom property date field just not the built in one. I am glad to see a feature request for this.

    Along with time series, I wish you could use time series in a report so you can visualize the patterns. Bar Charts and Pie Charts are good for some things but then time series as is returned in the searches would be awesome in a report.

    My $.02
    Posted By searlss2