topic Filtering out servers in Getting Data In

Filtering out servers

bgeshk — Tue, 29 Sep 2020 10:18:52 GMT

I'm trying to filter out servers that aren't getting a lot of traffic. So, I'm wondering how to filter out servers that are getting less than 10 requests per minute.

Right now, I'm getting the transactions per second of each JVM on all the servers:

index=att_prod_ecomm_open-api_rest sourcetype=att_openapi_access_log NOT "/openapi-rest-web/index.html" | bucket _time span=1s | stats count by _time | stats avg(count) as Average_TPS | appendcols [search index=att_prod_ecomm_open-api_rest sourcetype=att_openapi_access_log NOT "/openapi-rest-web/index.html" | stats count by source | stats count as jvm] | eval final = Average_TPS/jvm | gauge final

But i want to disregard the servers that get less than 10 requests per minute. Thanks!

Re: Filtering out servers

somesoni2 — Mon, 18 Jul 2016 14:23:02 GMT

Try like this

index=att_prod_ecomm_open-api_rest sourcetype=att_openapi_access_log NOT "/openapi-rest-web/index.html" | bucket _time span=1s | eval temp_time=_time | bucket span=1m temp_time | eventstats count by temp_time source | where count>=10| stats dc(source) as jvm count  by _time | eval avg=count/jvm | stats avg(avg) as Average_TPS| gauge Average_TPS

Re: Filtering out servers

bgeshk — Mon, 18 Jul 2016 16:40:43 GMT

Thank you very much. That makes a lot more sense!