Hello
I want to use two timecharts:
1st to build the max value per day, Database
2nd to build to sum of the first values from the timechart per day
The code looks like the following:
index=msexchange eventtype=msexchange-database-stats | timechart span=1d max(FileSize) as maxDBSizeperday by Database | timechart span=1d sum(maxDBSizeperday)
This doesn't work.
Could anyone help me?
↧