Hi Sukisen,
Basically, I am trying to add all the above mentioned fields' values into one field and that I call as "Size". Then I want to find size difference i.e., delta between two time intervals. For example, Delta = July month's size value - June month's size value.
As per below query I am getting the attached screenshot 1:
index=main|timechart span=1w sum(DATA_MB) as datamb, sum(INDEX_MB) as indexmb, sum(DB2_DATA_MB) as db2datamb, sum(DB2_INDEX_MB) as db2indexmb, sum(DB2_LOB_MB) as db2lobmb, sum(DB2_LONG_MB) as db2longmb, sum(DB2_XML_MB) as db2xmlmb by DOMAIN limit=25
Analytic Platform and Financial are the Domains which I used. my query is giving me the size value of each DB for each Domain.
For calculating the delta value of consolidated size details of all db, I have to add the below query into my current query:
| untable _time DOMAIN sum | streamstats current=false window=1 global=false sum(sum) as p_sum by DOMAIN | eval delta=sum-p_sum |stats sum(delta) as Delta by DOMAIN
Before adding this query, I should have a field which holds the summed up value of all the 7 fields which I mentioned earlier.
i.e., var = datamb+indexmb+db2datamb+db2indexmb+db2lobmb+db2longmb+db2xmlmb
So that I could change my delta query accordingly and add into my old query. My final answer I would get is as per attached example screenshot 2:
... View more