Dashboards & Visualizations

How to convert the query into trend

aditsss
Motivator

Hi Everyone,

I have below query.

index="abc*" OR index="xyz*" | eval raw_len=len(_raw) | stats sum(raw_len) as total_bytes by sourcetype |eval MB=total_bytes/pow(1024,2)| stats sum(MB)

I have want to convert it into Trend line for Today.

How can I change my query .

Can someone guide me on that 

As of now its showing sum

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You know how to do trends as you have demonstrated in the past e.g. https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-total-counts-for-SUCCESS-AN...

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...