Hi,
Currently i am running below query and it is showing me data in bytes. How do I convert in into GB's?
index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | sort -total_usage
Thanks in Advance
Try this:
index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | eval total_usage = round((total_usage/1024/1024/1024), 2) | sort -total_usage
Try this:
index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | eval total_usage = round((total_usage/1024/1024/1024), 2) | sort -total_usage
It can be nice to define a new field for this purpose via -
Fields >> Calculated fields >> Add new
It will depend upon the usage. LIke here, in-search calculation will be faster as it's done after the aggregation command (chart), and would be in-efficient (relatively) if it was a calculated field.
One performance improvement suggestion on @javiergn's answer, to do the lookup after the chart command.