Query/Dashboard for Total Events Processed by IDR for last 30/90 Days

Has anyone found a way to create a query (ideally to use in a dashboard) to show the total events processed for the last 30 days and/or quarter? If so, do you mind sharing it?

I can see on the Home page that it shows the total events processed for the last 24 hours, but I can’t find how to see this for the last 30 or 90 days. I want them as metrics for one of my big quarterly reports for leadership at my organization.

Unless I am misinterpreting what you are looking for in a dashboard, isn’t this accomplished by selecting all log sources, choose a range of 30 days (or leave to dashboard time and select on the dashboard), and use the query: calculate(count)

Then choose the “Number” chart.

1 Like

Thanks, that worked. I mistakenly did “groupby” instead of calculate.