Hello,
I am extracting from a database the list of the largest 20 tables. The format would be something like =:
For example:
TableSizeMB
LargestTable=2012
VeryLargeTable=2008
SomeTable=500
Obviously, the list is not fixed as some tables might become larger and make it to the list while others would disappear.
Would it be possible to have a graph of these tables and their sizes? If yes, how should I define the search?
Thank you in advance.
As far as the search, it's pretty much trivial
your search that gets tablename and tablesize
| sort 20 - tablesize
If you want to display all 20, then in splunk I'd suggest using a horizontal bar chart. Here's some run-anywhere sample code so you can see what it looks like.
| makeresults | eval junk=mvrange(1,25) | mvexpand junk | eval tablename="T".junk | eval tablesize = random()%125 + random()%221 | sort 20 - tablesize | table tablename tablesize