Super difficult to define the logic for a reduction in volume. I struggle with this myself. Volume decreases after hours (totally normal) and on weekends (again, normal) so showing a drop in volume alone doesn't really mean much. False alerting all the time. Now if I get 0 ingestion for a time period within business hours... that means something. Hard to work around change control windows, maintenance windows, etc as well. If anyone has some good ideas, I'm certainly all ears as well. ... View more

Depends on how you want the presentation, there are several ways. This one will add the total for the week on to each relevant record as a column... | eventstats sum(GB) as totGB by indexname sourcetypename This one will add a new row record at the end for each combination... | appendpipe [| stats sum(GB) as GB by indexname sourcetypename | eval _time = "total"] ... View more