I am using this search to get license use over 30 days
index="summary_indexers" | timechart partial=f span=1d sum(kb) as KB | eval gb=round(KB/1048576,1) | convert timeformat="%A - %m/%d" ctime(_time) AS DATE | table DATE gb
This gives ma b bar chart with one bar per day.
I would like to put a RED SLA line at the license limit so that the managers can clearly see where the License SLA will be violated and how close we are to that line.
Except for the RED part (which is configurable as part of the viewstate / dashboard config), this search adds in your SLA line:
index="summary_indexers"
| eval sla=20
| timechart partial=f span=1d sum(kb) as KB,max(sla) as SLA
| eval gb=round(KB/1048576,1)
| convert timeformat="%A - %m/%d" ctime(_time) AS DATE
| table DATE gb SLA
Except for the RED part (which is configurable as part of the viewstate / dashboard config), this search adds in your SLA line:
index="summary_indexers"
| eval sla=20
| timechart partial=f span=1d sum(kb) as KB,max(sla) as SLA
| eval gb=round(KB/1048576,1)
| convert timeformat="%A - %m/%d" ctime(_time) AS DATE
| table DATE gb SLA
Thanks that did it
Hi,
I have 10 services being displayed in a single chart. And i want to project 10 different SLAs for the different services.
If i use the below method, it gives me same sla for all.
| eval sla=20
Is there any way to do it.
Kindly advise.