topic Re: Summary Index search problems in Knowledge Management

Summary Index search problems

twinspop — Mon, 02 Aug 2010 22:16:13 GMT

My scheduled search:

[Summary Logins Per Second]
action.summary_index = 1
action.summary_index._name = lgn-stats
cron_schedule = 10 5-17 * * 1-5
dispatch.earliest_time = -15m@m
dispatch.latest_time = -5m@m
displayview = flashtimeline
enableSched = 1
realtime_schedule = 0
request.ui_dispatch_view = flashtimeline
search = SYSCODE=LGN-*  | sitop _time
vsid = gc6frvm6

After running through a few cycles this morning, I ran this search:

index=lgn-stats search_name="Summary Logins Per Second" | top _time

Our app is particularly busy at the top of the hour. I'm trying to grab the busiest seconds at the top 10 minutes of every hour (X:55:00 - Y:05:00) for monthly reporting. However, the SI search above is returning total events for the entire 10 minutes as the top entries, followed by the top seconds that I really want. Example:

time count percent
1   8/2/10 5:55:00.000 AM   55770   inf
2   8/2/10 6:55:00.000 AM   34025   inf
3   8/2/10 4:55:00.000 AM   24479   inf
4   8/2/10 5:56:59.000 AM   155 inf
5   8/2/10 6:00:05.000 AM   144 inf
6   8/2/10 5:58:40.000 AM   137 inf
7   8/2/10 5:59:30.000 AM   136 inf
8   8/2/10 5:58:42.000 AM   134 inf
9   8/2/10 6:00:12.000 AM   131 inf
10  8/2/10 5:59:25.000 AM   128 inf

Apparently I've misunderstood something basic about the SI command set. Any tips?

Thanks, Jon

Re: Summary Index search problems

dskillman — Tue, 03 Aug 2010 05:57:07 GMT

I think the search you want is:

SYSCODE=LGN-* | timechart count span=1s

This will return the # of matching events in 1 second buckets, or whatever bucket you want. Try it without the si. You can sort it by count to find the 'second' that has the most events.

If it works then just tack on the sitimechart and use that recurring search to fill your summary.

SYSCODE=LGN-* | sitimechart count span=1s

Re: Summary Index search problems

twinspop — Tue, 03 Aug 2010 21:30:42 GMT

Yeah, that's what I've ended up doing. I was trying avoid large result collections, only wanting to keep the top X results each time. (Not exactly what I wanted, but good enough for a check mark.)

Thanks!