Hi,
I am using a single search string with two different time rage to find the disk space.
Search string : index= source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | chart avg(volume)
1. Time range of last 24 hours
2. Time range of Previous month
By using this I am getting two different charts as output.
I need the string to find the difference between these two charts. or a single string to define the disk space of current day and 30 days before (previous month)
Thanks,
How about this?
index_earliest=-1d@d index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E
| eval volume=Free_Megabytes/1024
| bin _time bins=30
| stats avg(volume) as daily_Kilobytes by _time
| append
[
search index_earliest=-1mon@mon index_latest=@m index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E
| bin _time span=1d
| eval volume=Free_Megabytes/1024
| stats avg(volume) as monthly_Kilobytes by _time
]
| timechart values(daily_Kilobytes) values(monthly_Kilobytes)
How about this?
index_earliest=-1d@d index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E
| eval volume=Free_Megabytes/1024
| bin _time bins=30
| stats avg(volume) as daily_Kilobytes by _time
| append
[
search index_earliest=-1mon@mon index_latest=@m index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E
| bin _time span=1d
| eval volume=Free_Megabytes/1024
| stats avg(volume) as monthly_Kilobytes by _time
]
| timechart values(daily_Kilobytes) values(monthly_Kilobytes)
@jkat54 - m
is minute. Probably need to use -30d@d
.
Thank you and it worked
i always do that, thanks... updated to mon for month
how about using timechart command? set the timepicker to last 30 days
index= source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | timechart span=24h avg(volume)
hope it helps
Thank you and it worked