topic Re: Search optimization question in Knowledge Management

Search optimization question

jonydupre — Thu, 10 Oct 2019 08:22:59 GMT

Hi all,

I had some trouble with a search but got it to work. But the search istelf isn't that "clean" I suppose.
Someone mentioned Timechart but I couldn't get it to work.

This is the search:

index=linux host="i*soe*" earliest=-1d@d latest=@d "healthcheck: System not healthy" | dedup host | stats count by host
| stats count as TotalA
| appendcols 
[search index=linux host="i*soe*" earliest=@d latest=now "healthcheck: System not healthy" | dedup host | stats count by host 
| stats count as TotalB]
| appendcols 
[search index=linux earliest=-2d@d host="i*soe*" latest=-1d@d "healthcheck: System not healthy" | dedup host | stats count by host 
| stats count as TotalC]
| eval Gister=TotalA 
| eval Vandaag=TotalB
| eval Eergisteren=TotalC
| fields HealthchecksError, 2days ago, Yesterday, Today

Would there be a way to improve the search syntax wise?
Thanks!

Re: Search optimization question

gcusello — Thu, 10 Oct 2019 10:51:48 GMT

Hi jonydupre,
your search isn't so clear, can you better describe what you want to have as result?
The total count of different hosts for each day?
eventually divided by HealthchecksError?

Anyway, reading you search I see that you don't need the first stats count (| stats count BY host ) because you have a dedup before and another stats count after.

Then I see that you used appendcols with the same search in a different period, while you could use timechart command, something like this:

 index=linux host="i*soe*" earliest=-2d@d latest=now "healthcheck: System not healthy" 
| timechart span=1d dc(host) AS n_hosts

If you want also differentiate the count of different hosts by HealthchecksError, you can add this clause to the timechart:

 index=linux host="i*soe*" earliest=-2d@d latest=now "healthcheck: System not healthy" 
| timechart span=1d dc(host) AS n_hosts BY HealthchecksError

Bye.
Giuseppe