Hi,
I got some raw data like :
Backup-ID: host1.domain.fr_1
Fragment Size (KB): 4425792
Expires: 20/03/2015
MediaID: AZER12
Extracted fields :
fragment_size : "(KB) 4425792"
date : "20/03/2015"
I'd like to get a chart of the sum(fragment_size) by date
I've tried many combinations with sum(value), stats, chart etc, but it seems that I missed something because I can't get a result.
Can you help me?
Alex.
Your fragment_size
is not a number. Either extract the number without the "(KB: )" in front, or do some replacing and multiplying-by-unit afterwards.
regex
is a filtering command, try rex field=fragment_size "(?\d+)
instead.
Once that works, fix your initial field extractions to extract the correct number in the first place.
Yep, i've tried with |regex fragment_size="\d+"
but still, the sum was null