I display two different graphs by using the following strings.
"Sending" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes sent"
"Receiving" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes received"
I can display both in the same graph by:
"Sending" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes sent" | appendcols [search "Receiving" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes received"]
This gives me two lines (each has a value for one day for the past 7 days).
How do I display the difference between gigabytes sent and received? I want to display Gigabytes sent - gigabytes received for each day for the past 7 days.
Try this
"Sending" OR "Receiving" earliest=-7days | rex "(?<action>Sending|Receiving)" | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) as gb by action | eval diff=Sending-Receiving
Try this
"Sending" OR "Receiving" earliest=-7days | rex "(?<action>Sending|Receiving)" | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) as gb by action | eval diff=Sending-Receiving
Is the syntax correct? I get null for y-axis description.
Also avg bytes from sending and receiving should be separate. Wouldn't this combine all of them together ?
Do you not see columns for Sending and Receiving? The avg(gb) will be calculated separately for each action. If NULL is the third column, you could add usenull=f
to the timechart command. You search would look like this
index=myIndex sourcetype=mySourcetype "Sending" OR "Receiving" earliest=-7d@d | rex "(?<action>Sending|Receiving)" | eval gigabytes=((bytes/1024)/1024) | timechart usenull=f span=1day avg(gigabytes) as gb by action | eval diff=Sending-Receiving