Greetings!
I have access logs from multiple sources that I'd like to combine into the same graph, basically to count the number of hits per minute on each source.
index=ihs source="*_access_log.*" | timechart span=1m count(eval(source="/logdir/http-logs/source1_access_log.%Y%m%d")) AS source1, count(eval(source="/logdir/http-logs/source2_access_log.%Y%m%d")) AS source2, count(eval(source="/logdir/http-logs/source3_access_log.%Y%m%d")) AS source3, count(eval(source="/logdir/http-logs/source4_access_log.%Y%m%d")) AS source4
Basically each source has its own name and today's date. I'm not really sure how to approach it, but the above and everything else I've been trying doesn't work.
Thanks,
Aaron
... View more