Hello
I want to use two timecharts:
1st to build the max value per day, Database
2nd to build to sum of the first values from the timechart per day
The code looks like the following:
index=msexchange eventtype=msexchange-database-stats | timechart span=1d max(FileSize) as maxDBSizeperday by Database | timechart span=1d sum(maxDBSizeperday)
This doesn't work.
Could anyone help me?
See if this works:
index=msexchange eventtype=msexchange-database-stats
| bin span=1d
| stats max(FileSize) as maxDBSizeperday by Database , _time
| stats values(maxDBSizeperday) sum(maxDBSizeperday) by Database, _time
It should produce a statistics table that you can then take to the visualization tab and it will look just like a timechart if you select a line chart etc.
Try this
index=msexchange eventtype=msexchange-database-stats | timechart span=1d max(FileSize) as maxDBSizeperday by Database | addtotals | table _time Total
See if this works:
index=msexchange eventtype=msexchange-database-stats
| bin span=1d
| stats max(FileSize) as maxDBSizeperday by Database , _time
| stats values(maxDBSizeperday) sum(maxDBSizeperday) by Database, _time
It should produce a statistics table that you can then take to the visualization tab and it will look just like a timechart if you select a line chart etc.