Deployment Architecture

Help bucketing time with mcollect?



I am running this search to collect exceptions by host. I am bucketing into 1min intervals. However when I go back with mstats or the metrics work bench - data is being time stamped at the point of the summary job run rather than at the _time of the bucket itself.

tag=java host=mydc* priority=error OR priority=warning OR priority=fatal java_exception=* role=* host=*abc*
| rex field=host (?<pod>\w\w\w\w\d\d)
| bin _time span=1m 
| stats first(_time) as _time count by pod,role,java_exception, priority
| rename count as _value 
| eval metric_name=""
| mcollect index=testmetrics 

The results table LOOKS fine. But the final product has the wrong time.

0 Karma