topic Re: Multiseries chart in Dashboards & Visualizations

Multiseries chart

kp_pl — Wed, 20 Mar 2024 22:29:23 GMT

At the beginning two examples :

the first one:

index=s1 | timechart sum(kmethod) avg(kduration)

generates two series chart

second one uses 'count by':

index=s1 | timechart count by kmethod

generates just one series .

I would like to join both timecharts and kind of merge "count by" with simple "avg" or "sum" so :

-first one 'stacked bar' from second example

-second one 'line' from second series of the first example

Any hints ?

Re: Multiseries chart

ITWhisperer — Wed, 20 Mar 2024 23:10:51 GMT

It is not clear what you are trying to do here - the second one generates a count for each unique value of kmethod - which presumably is a number since the first one is summing these?

Please can you clarify what you are trying to do, perhaps provide some sample (anonymosed) events so we can see what you are dealing with, and an example of your expected result?

Re: Multiseries chart

kp_pl — Wed, 20 Mar 2024 23:23:22 GMT

Well - I always have problem with clear explanation, sorry about it.

So look at the graph below

kp_pl_0-1710976511586.png

It is exactly what I need . One "series" - bars is a count for each uniqe value >> timechart count by kmethod
Second series , black line, just a simple sum or average function >> timechart sum(kmethod)

Re: Multiseries chart

ITWhisperer — Thu, 21 Mar 2024 08:29:01 GMT

Still not clear - from your chart, it appears that kmethod is a string (jura_... etc). How do you then either sum these strings or take an average?

Re: Multiseries chart

kp_pl — Thu, 21 Mar 2024 08:51:45 GMT

of course, the chart is correct , explanation is bad - my mistake

so the first series - no doubt

timechart count by kmethod

the second one of course sum/avg numbers

timechart avg(duration)

All data comes from access.log which format is something like :

TIMESTAMP;IP;HTTP_METHOD;METHOD;RETURN_CODE;DURATION;BYTES;UUID

Re: Multiseries chart

ITWhisperer — Thu, 21 Mar 2024 09:30:34 GMT

Assuming you want average duration from all events, you could do something like this

Using dummy data, gives something like this

ITWhisperer_0-1711013423505.png

Re: Multiseries chart

kp_pl — Thu, 21 Mar 2024 10:32:43 GMT

Nice 🙂

It is almost what I need and expect.

Just give me one more hint regarding _time . I want to show data from the past, from last monday between 9am and 5pm .

Re: Multiseries chart

ITWhisperer — Thu, 21 Mar 2024 11:52:52 GMT

Change your time-picker to be the time period you want