how to modify my query to display a detail view with hosts?

[pavanae]

I have a search as follows

field="abc"| eval b=len(_raw) | timechart span=1h sum(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2) | eventstats avg(gb) as Avg

Which displays the result as follows

Now I want to modify my search to see a time chart which displays the average gb for each host per hour. Is there any way to modify my search to display like that?

[woodcock · Accepted solution]

The trick is that you need to do the "bucketing" that timechart does, twice: once to calculate each hosts's hourly sum and then again to avg all hosts' sums. This is a exactly why the bucket (AKA bin) command exists. Do it like this:

field="abc"| eval b=len(_raw)
| bucket _time span=1h | stats sum(b) AS b by _time host
| timechart span=1h avg(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2)

[javiergn]

Based on your indications above:

I want to modify my search to see a time chart which displays the average gb for each host per hour

I guess this is what you are looking for:

field="abc"
| eval b=len(_raw) 
| timechart span=1h avg(b) as b by host
| foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024,10)]

NOTE: I have rounded that to include up to 10 decimals mainly because I don't know how much data is going through your hosts but feel free to revert that back to 2 o whichever value fits your needs.

[inventsekar]

field="abc"| eval b=len(_raw) | timechart span=1h sum(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2) | eventstats avg(gb) as Avg by host

[pavanae]

Hi sorry there isn't any change in my result.