Multiseries chart

[kp_pl]

At the beginning two examples :

the first one:

index=s1
| timechart sum(kmethod) avg(kduration)

generates two series chart

second one uses 'count by':

index=s1
| timechart count by kmethod

generates just one series .

I would like to join both timecharts and kind of merge "count by" with simple "avg" or "sum" so  :

-first one 'stacked bar' from second example

-second one 'line' from second series of the first example

Any hints ?

K.

[ITWhisperer]

It is not clear what you are trying to do here - the second one generates a count for each unique value of kmethod - which presumably is a number since the first one is summing these?

Please can you clarify what you are trying to do, perhaps provide some sample (anonymosed) events so we can see what you are dealing with, and an example of your expected result?

[kp_pl]

Well - I always have problem with clear explanation, sorry about it.

So look at the graph below

It is exactly  what I need . One "series" - bars is a count for each uniqe value >> timechart count by kmethod
Second series , black line, just a simple sum or average function >> timechart sum(kmethod)

[ITWhisperer]

Still not clear - from your chart, it appears that kmethod is a string (jura_... etc). How do you then either sum these strings or take an average?

[kp_pl]

of course, the chart is correct , explanation is bad  - my mistake

so the first series - no doubt

timechart count by kmethod

the second one of course sum/avg numbers

timechart avg(duration)

All data comes from access.log which format is something like :

TIMESTAMP;IP;HTTP_METHOD;METHOD;RETURN_CODE;DURATION;BYTES;UUID

[ITWhisperer]

Assuming you want average duration from all events, you could do something like this

| bin _time span=30m
| eventstats count by _time method
| appendpipe
    [| eventstats sum(duration) as count by _time
    | eval method="duration"]
| xyseries _time method count
| addtotals fieldname=total
| eval total=total-duration
| eval average=duration/total
| fields - duration total

Using dummy data, gives something like this

[kp_pl]

Nice 🙂

It is almost what I need and expect.

Just give me one more hint regarding _time . I want to show data from the past, from last monday between 9am and 5pm .  

[ITWhisperer]

Change your time-picker to be the time period you want