How to chart sum(value) by date ?

[afourdraine]

Hi,

I got some raw data like :

Backup-ID: host1.domain.fr_1
Fragment Size (KB): 4425792
Expires: 20/03/2015
MediaID: AZER12

Extracted fields :
fragment_size : "(KB) 4425792"
date : "20/03/2015"

I'd like to get a chart of the sum(fragment_size) by date

I've tried many combinations with sum(value), stats, chart etc, but it seems that I missed something because I can't get a result.

Can you help me?

Alex.

[martin_mueller]

Your fragment_size is not a number. Either extract the number without the "(KB: )" in front, or do some replacing and multiplying-by-unit afterwards.

[martin_mueller]

regex is a filtering command, try rex field=fragment_size "(?\d+) instead.

Once that works, fix your initial field extractions to extract the correct number in the first place.

[afourdraine]

Yep, i've tried with |regex fragment_size="\d+" but still, the sum was null