Something like this?
source="Perform:FOO" instance!="_Total" | chart latest(Value) by instance
This s what I mean...
Something like this?
source="Perform:FOO" instance!="_Total" | chart latest(Value) by instance
I see. In that case, go back to my original answer (minus the typo):
source="Perfmon:FOO" instance!="_Total" | chart latest(Value) by instance
Oh, yeah. What I mean, however, is I want to be able to only see one instance of the SET of drives. 3 bars total in this case, for C:, D:, and E:.
If you only want to see "C:" for example you can add instance="C:" to the search query.
Not sure I understand. Can you clarify?
If you want only one instance in the result you could add a filter by instance to the initial search.
That does work, but now I get a chart for every instance of the log, let's say for the past 24 hours. How do I force it to only show one "set" of numbers?