I have three individual searches for a single value viz. the value for each viz is a sum of a field.
I have bytes, bytes_in, and bytes_out. Each search is | stats sum(bytes) as Total, sum(bytes_in) as In, and sum(bytes_out) as Out
So 3 searches for each field, and a single value viz for each field. I have looked at the trellis viz, but it is not much help. My actual spl is using the same formula for each field: index=squid | stats sum(bytes_in) as TotalBytes | eval gigabytes=TotalBytes/1024/1024/1024 | rename gigabytes as "Bytes In" | table "Bytes In"
Is there some way to put all three stats commands in the same search, and maybe the trellis can get each calculation? I looked at trying to put each single value in a table 3 column by one row, etc
How can this be accomplished.
... View more