topic Re: How to graph with multiple fields by _time in Getting Data In

How to graph with multiple fields by _time

it_systems — Wed, 25 Sep 2019 13:57:47 GMT

Hey community,

Browsed a lot of posts, but did not found any answer to my problem...

I have a sourcetype that give me this kind of results for a row, here is 3 exemples :

_time=2019-09-25T15:40:34.000+02:00,UP=45,WARN=12,DOWN=5
_time=2019-09-25T15:41:34.000+02:00,UP=43,WARN=14,DOWN=3
_time=2019-09-25T15:42:34.000+02:00,UP=45,WARN=12,DOWN=3

UP,WARN and DOWN values are a count of "status" (UP,WARN and DOWN) at _time (these results are retrieved through REST API sourcetype, so I cannot change anything at the indexing level)

I would like to build a graph showing "status" by _time

Unfortunately, it seems that a timechart can only be built based on some count() or avg() or sum() ... etc but since my values are already a count, what can be my options here? All my tries led to displaying incorrect data 😞

Thank you in advance!

Re: How to graph with multiple fields by _time

jacobpevans — Wed, 25 Sep 2019 15:30:37 GMT

Greetings @it_systems,

You need to use an aggregate function for timechart to work properly. There is no way around that. In your case, you'd want sum(). If you want to keep the same values - since your data points are 1 minute apart, use span=1m to force that. Here's a run-anywhere search so you can see what I mean (run it for the last 5 minutes):

           | makeresults | eval _time=now()-  0, UP=45, WARN=12, DOWN=5
| append [ | makeresults | eval _time=now()- 60, UP=43, WARN=14, DOWN=3 ]
| append [ | makeresults | eval _time=now()-120, UP=45, WARN=12, DOWN=3 ]
| append [ | makeresults | eval _time=now()-180, UP=0,  WARN=10, DOWN=20 ]
| append [ | makeresults | eval _time=now()-240, UP=50, WARN=50, DOWN=50 ]
| timechart span=1m sum(DOWN) as DOWN, sum(UP) as UP, sum(WARN) as WARN

Re: How to graph with multiple fields by _time

it_systems — Wed, 25 Sep 2019 16:06:20 GMT

Thanks @jacobevans !

That did the trick 🙂

Thank you very much for your help!

Re: How to graph with multiple fields by _time

jacobpevans — Thu, 26 Sep 2019 13:46:07 GMT

You're welcome! Thank you for accepting the answer.