I have 2 searches :`
index=os_windows Host="usatlb9*" object="Network Interface" counter="Bytes Total/sec" |timechart span=30m max(Value) as "Total Bytes Per Second" by host
index=os_windows Host="usatlb9*" object="Network Interface" counter="Current Bandwidth" |timechart span=30m max(Value) as "Maximum Network Bandwidth" by host
The field name, 'Value', is the same in both searches. I want to combine both of these line charts into one line chart so that I can see the total bytes per second over the maximum network bandwidth .
Please help! Thanks!
This will do it:
index=os_windows Host="usatlb9*" object="Network Interface" | bucket _time span=30m | stats max(Value) AS Max by _time host counter | timechart span=30m first(Max) AS "Total Bytes Per Second" last(Max) AS "Maximum Network Bandwidth" by host
You might have to swap the names around (the part after AS
).
WARNING: There will be problems if you have any period of 30 minutes without at least 1 log for each object+host
This will do it:
index=os_windows Host="usatlb9*" object="Network Interface" | bucket _time span=30m | stats max(Value) AS Max by _time host counter | timechart span=30m first(Max) AS "Total Bytes Per Second" last(Max) AS "Maximum Network Bandwidth" by host
You might have to swap the names around (the part after AS
).
WARNING: There will be problems if you have any period of 30 minutes without at least 1 log for each object+host