Log Volume Indexed.

[sanju005ind]

I would like to display the volume indexed from several indexed into following chart.

• Past 24hrs log volume by time (line graph)
• Past week’s log volume (bar chart – bar for each day)

It should be Per Host combined since would be filtering the hosts by tags.

[gkanapathy]

earliest=-24h index=_internal source=*metrics.log group=per_host_thruput | rename series as host | tags | where tag=mytag | timechart span=1h sum(kb) by host

earliest=-7d@d latest=@d index=_internal source=*metrics.log group=per_host_thruput | rename series as host | tags| where tag=mytag | timechart span=1d sum(kb) by host

[sanju005ind]

"index=_internal metrics group=per_host_thruput startdaysago=7 | rename series as host | tags | search tag::host=MyTags | bucket span=1d _time | stats sum(kb) as kb by date_mday" . This works for me.Is there any fine tuning to be done?

[sanju005ind]

"index=_internal source=*metrics.log group=per_host_thruput | rename series as host | tags | search tag::host=mytag" this seems to work However when I check this I get very less hosts compared to "
| metadata type=hosts | TAGS | search tag::host=mytag | eval host=lower(host) | fields host| rename host as "series" | join
series[search index="_internal" source="*metrics.log" per_host_thruput | stats sum(kb) by series] "