Hi All.
I run the below search
sourcetype=dbx3_netapp_vault_utilization
it returns the below: (names redacted)
I need to create a line chart that shows the "name" and "volumeUsed" from 48 hours ago compared to 24 hours ago so we can trend our snapshot size.
Hi @shanecifaldi,
how about something like this.
sourcetype=dbx3...zation earliest=-24h@h latest=@h | timechart span=1h sum(volumeUsed) AS volume_last_24h by name
| append [search sourcetype=dbx3...zation earliest=-48h@h latest=-24h@h | timechart span=1h sum(volumeUsed) AS volume_last_48h by name]
Hi @shanecifaldi,
how about something like this.
sourcetype=dbx3...zation earliest=-24h@h latest=@h | timechart span=1h sum(volumeUsed) AS volume_last_24h by name
| append [search sourcetype=dbx3...zation earliest=-48h@h latest=-24h@h | timechart span=1h sum(volumeUsed) AS volume_last_48h by name]
this works well but there is one issue - for some reason almost 1/2 of the volumes are being grouped as "other".
thanks for your help i figured it out with the limit=0 syntax.