We are having problem with some of our indexes growing rapidly. I am trying to figure out a search/alert that have a deviation by the hour compared to previous days at the same time. I have the following search below that gives me the usage by the hour. Any help would be greatly appreciated. index=_internal group="per_index_thruput" earliest = -1h@h latest=@h | eval mb=kb/1024 | timechart span=1h sum(mb) as HourlyTotal | addtotals fieldname=HourlyTotal | streamstats sum(HourlyTotal) AS AccumulatedTOTAL | bucket _time span=1d ... View more

I am having an issue with no results in the Summery View. Would someone be able to provide the search string for "Location Summary"? ... View more