I tried this:
index=internal metrics kb series!=* group="per_index_thruput"| eval indexed_GB = (kb / 1024 / 1024) | timechart eval(round((sum(indexed_GB)),2)) as TotalGB fixedrange=t span=1d
Then went back to this: Status > Index activity > Indexing volume, splitting for one host and a given day.
The first says 1.99GBs, the second (when my indexes, not internals, are added up) says 1.65GBs.
SOS (at v4.3.5) is buggy and until we upgrade I can't use that. I have a command line that looks interesting but want a search I can save and configure email reports with. Is there a search that jibes with other tools?
... View more