Hello,
I have 3 guest and each guest has 10 hosts in it. i want to display data in pie chart.
my query conditions are :
Want to display sum of latest value over hosts by guest.
First i need to find out latest values of host and then sum up that values guest.
My current query is:-
index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | chart first(Power_consumption) as a over host by guest
This query is giving latest values of hosts by guest. Next i need to sum up latest values. What would be the approach to do this.
Please help, if anybody knows the solution.
Thanks in advance.
Geetanjali
Keep your original search for the first need and use this one for the other need:
index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | stats first(Power_consumption) as a BY host,guest | stats sum(a) BY host
Sounds like you could use the addtotals search command so try the following search query: your_search | addtotals