I would like to get o/p as below
I am using
index=xxxx sourcetype="log" "Database =" AND "Size" host=xxxxx | eval date=strftime(_time, "%Y-%m-%d") |eval Size_MB = replace(Size,"MB","") | eval Size_MB = replace(Size,"MB","") |table date Database Size_MB | addtotals
But it give Total per row instead of combining rows or toal of database per day.
You can try something like this
index=xxxx sourcetype="log" "Database =" AND "Size" host=xxxxx
|eval date=strftime(_time, "%Y-%m-%d")
|eval Size_MB = replace(Size,"MB","")
|convert num(Size_MB) as Size_MB
|table date Database Size_MB
|eventstats sum(Size_MB) as Total by date
let me know if this helps!
The Total value is set for all rows and not as per the above.
Try this!
index=xxxx sourcetype="log" "Database =" AND "Size" host=xxxxx
|eval date=strftime(_time, "%Y-%m-%d")
|eval Size_MB = replace(Size,"MB","")
|table date Database Size_MB
|streamstats count as No by Data
|eventstats sum(size) as Total,max(No) as Max_No by date
|eval Total=if(No=Max_No,Total,"")
|table date Database Size_MB Total
The Total value is set for all rows and not as per the above.
Fix to display total on the last line.
I have never done it before ...