Try this
index=_internal source=*metrics.log group=per_index_thruput series!="_*" | bucket span=1d _time | eval totalMB = round(kb/1024,4) | eval Date=strftime(_time,"%Y-%m-%d") | chart sum(totalMB) over series by Date
Try this
index=_internal source=*metrics.log group=per_index_thruput series!="_*" | bucket span=1d _time | eval totalMB = round(kb/1024,4) | eval Date=strftime(_time,"%Y-%m-%d") | chart sum(totalMB) over series by Date
You can something try this:
index=_internal source=*metrics.log group=per_index_thruput series!="_*" | eval totalGB = (kb/1024)/1024 | timechart span=7d sum(totalGB)
I am looking for a query which can output index and its usage. Something like below
name day1 day2 day3 day4 day5 day6 day7
index_a 1.2 1.3 1.5 1.1 1.7 0.9 1.1
index_b 3.2 3.2 3.5 3.7 4.0 3.2 3.2