...t is hitting the disk usage limit (500MB - which I can't increase) for a 10 days interval. And I'd like to be able to have this on a 3/4 months interval. What I have noticed is that If I only run t...
...ike 2.123456 i would like to round it off to four digits only.Tried using the round function along with the statscommand..but it didnt worked.
Please help me on this .Thanx
This a fairly big query, so only run it for the past couple of weeks.
index=_internal source=*license_usage.log type="Usage"|bin _time span=1d
|eval h=lower(h)
| stats sum(b) as b by idx, h, s...
...ound below queries . But couldn't get one for memory usage. Average CPU : index=os host=hostname sourcetype=cpu | multikv | search CPU="all" | eval pctCPU=100-pctIdle | stats avg(pctCPU) by host For m...
Hello, everyone!
I was encountered with weird problem. I have the following search:
| tstats `summariesonly` count by source, host, index, sourcetype | table source, host, index, sourcetype | stats...
Hello, I am a big fan of using Join for combining results of different sourcetypes and indexes (especially with a type=left parameter) but I do see alot of hate in the community towards the usage o...
I'm wondering if there is any option to have a showperc and useother functionality in stats/charts? They seem to be available only in top command which (if I'm correct) can only aggregate by count o...
...ub search is run first and every EventID is unique I would expect 6000 events. There is only one CustomerName shown in stats and it is the same in each row. T...