Unable to pull similar number 53726516638.77 (in billion) using chart for past 7 days?

[jimish]

Unable to pull similar number 53726516638.77 (in billion) using chart for past 7 days.

Dashboard only pulls data for only 1 day.

rex filed example :

rex field=_raw "(?ms)^\\w+/\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\.\\s+\\w+/\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\.\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+:\\s+\\d+\\.\\d+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+:\\s+\\d+\\.\\d+\\s+\\w+\\s+\\w+\\s+\\w+\\s+:\\s+\\.\\d+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+:\\s+(?P<TotalAsset>[^ ]+)" offset_field=_extracted_fields_bounds | eval mytime=strftime(_time, "%b%d") |chart values(Total_Assets_Price) by mytime

log output :

Want to pull total asset on pricing and previous date but somehow only pulls data for 1 day

[somesoni2 · Accepted solution]

Is data coming in same format every day? (try to run the search with time-range "Yesterday" and check.

Also give this a try

your base search
| rex field=_raw "Total Assets on Pricing Date:\s+(?P<TotalAsset>\S+)" offset_field=_extracted_fields_bounds | eval mytime=strftime(_time, "%b%d") |chart values(Total_Assets_Price) by mytime

[jimish]

Thank you this rex expression is better and pulled data from past two days .

[somesoni2]

What output do you get and what output you want?

[jimish]

Its only printing data for one day , for 20th also i need to see data as logs are updated as of 19th.