Hi all,
I'm trying to build a simple dashboard that shows a simple graph of bytes sent by a web server. I realize that I want to use the "Web" accelerated data model, or the searches will take a long time.
After looking at the "Web Center" dashboard, and some tinkering, I arrived at this search:
| `tstats` sum(Web.bytes) from datamodel=Web by _time | timechart sum(Web.bytes)
This search works a treat, and runs very quickly. However, the output shows the raw byte count, which is hard to read. I would like to output Gb instead. So, after some more tinkering, I arrived at this search:
| tstats sum("Web.bytes") as "total_bytes" FROM datamodel=Web by _time | timechart eval(sum(total_bytes)/(1024*1024*1024)) as "GB out"
This search shows exactly what I want, but runs very slowly. It seems that the difference is `tstats` vs tstats, i.e. quotes vs. no quotes. If I remove the quotes from the first search, then it runs very slowly. And if I add the quotes to the second search, it runs much faster, but no results are found, so it seems that `tstats` has different semantics when it comes to applying functions such as eval.
So I have two questions, the first being about the difference between `tstats` and tstats, and why there is such a big performance difference. The second question is why `tstats` seems to not have some functions available.
I realize I'm probably missing something really obvious!
Thanks for your help.
Cheers,
Thom.
