Search:
index=_internal source=*license_usage.log | eval ISODate=strftime(strptime(date_year."-".date_month."-".date_mday, "%Y-%b-%d"), "%Y-%m-%d (%a)") | eval MB=b/1024/1024 | chart eval(round(sum(MB),0)) over i by ISODate limit=0 | addcoltotals labelfield=i
I'm not sure the ISODate evaluation is the best way to achieve my end, but that is not the issue here. The problem is that when I use this chart, the column with the indexer UIDs is floated to the rightmost position in the table (presumably due to the fact that a simple alphanumeric string sort puts the dates before the letter "i"). What I need is to anchor the indexer column to the left regardless.
OK, so it only floats right during the real time aggregation. On completion it floats back left.
Odd behaviour, and not documented anywhere I could find.
OK, so it only floats right during the real time aggregation. On completion it floats back left.
Odd behaviour, and not documented anywhere I could find.