How to build max and sum in two timecharts per day

[tgdvopab]

Hello

I want to use two timecharts:
1st to build the max value per day, Database
2nd to build to sum of the first values from the timechart per day

The code looks like the following:

index=msexchange eventtype=msexchange-database-stats | timechart span=1d max(FileSize) as maxDBSizeperday by Database | timechart span=1d sum(maxDBSizeperday)

This doesn't work.
Could anyone help me?

[sundareshr]

Try this

index=msexchange eventtype=msexchange-database-stats | timechart span=1d max(FileSize) as maxDBSizeperday by Database | addtotals | table _time Total

[jkat54 · Accepted solution]

See if this works:

index=msexchange eventtype=msexchange-database-stats 
| bin span=1d
| stats max(FileSize) as maxDBSizeperday by Database , _time
| stats values(maxDBSizeperday) sum(maxDBSizeperday) by Database, _time

It should produce a statistics table that you can then take to the visualization tab and it will look just like a timechart if you select a line chart etc.