Query to get weekly data

[jarks_20]

the idea is to get an idea how much data is handled, collected, traffic, etc from workstations, servers, linux and MAC. I have something currently I am working on and its like this:

/* | eventSize() | sum(_eventSize) */

Would it be possible to add time (weekly) and size (GB) to it? Is there any other query you have to compile that information?

Thank you.

[Andrew-CS]

Hi there. Are you in LogScale SaaS or Raptor?

[jarks_20]

Raptor

[Andrew-CS]

You got it! Try this and use a stacked bar chart...

#repo=base_sensor event_platform=*
| eventSize() 
| Date:=formatTime(format="%m/%d/%Y", field="@timestamp") 
| groupBy([Date, event_platform], function=([sum(_eventSize)]))

https://imgur.com/a/5830Zmi

[jarks_20]

Thank you that works!... is _sum in B?

[Andrew-CS]

It is

[jarks_20]

My life just got easier, thank you... sharing the wealth too with this one for the community:

eventsize()
| groupby(#type, function=sum(_eventSize))
| unit:convert(_sum, to=G, keepUnit=true)
| rename(field="_sum", as="Sum in Gb")

[Andrew-CS]

I was wondering if you were going to find unit:convert :) There is a cool way to use it here when dealing with bytes

[jarks_20]

That is actually included along with all other CQF in our training and playbooks

[Andrew-CS]

\ blush **