Hi! I have a scenario where we have used "| stats count" and gotten the total number for the range that we picked. This has been working fine, but now, we'd like to use timechart to get trends. However, when using timechart , the number becomes the latest "bucket" instead of the total number. Example: Searching with a time range of 60 minutes would give me the value for the last minute. Been fiddling around with some suggestions but haven't found a reliable solution. This last one: | timechart [search index=_internal | head 1 | addinfo | eval timerange= info_max_time-info_min_time | eval span=if(round(timerange/3600) == infinity, 1, round(timerange/3600))."h" | return span] count | appendpipe [stats count | where count=0] It generates errors like "Error in timechart command. The value for option span (infinityh) is invalid." Any ideas of what I'm doing wrong? /Patrik ... View more

Hi! Is it possible and/or advisable to host a lookup file on a Windows share? We are considering putting it on a central location to be used by multiple search heads. If possible, is the file read and committed to memory so each lookup does not have to go over the network? Kind regards, Patrik ... View more

Dear experts I must confess this post and question is not properly defined. It's more a chance to pick your brains regarding investigating bandwidth usage. We have a bunch of servers grouped by IDs. They're named as WEBXX-YY, where XX is the cluster id and YY is the node id. Each cluster serves its own application and the load is distributed between the different nodes. My task is to investigate which application is using the most bandwidth. I ran this search to check which application uses the most bandwidth: index=webfront sourcetype=iis host WEB* | eval hostname = split(host, "-") | eval hostname = mvindex(hostname,0) | eval sumMB = ((cs_bytes*8)/(1024*1024) + (sc_bytes*8)/(1024*1024)) | timechart span=1m per_second(sumMB) by hostname But since the clusters have different amounts of clients it's not a fair comparison so my though was to find the average bandwidth per transaction per application. Defining transaction by c_ip and maxpause=1s, is there a way of measuring the average bandwidth per transaction per cluster? The result table would be: "average per_second(sumMB) per transaction", cluster I would like to present this with a timechart. Hope the question is somewhat clear? Suggestions regarding alternative approaches is most welcome! Kind regards, Patrik ... View more