How to graph with multiple fields by _time

[it_systems]

Hey community,

Browsed a lot of posts, but did not found any answer to my problem...

I have a sourcetype that give me this kind of results for a row, here is 3 exemples :

_time=2019-09-25T15:40:34.000+02:00,UP=45,WARN=12,DOWN=5
_time=2019-09-25T15:41:34.000+02:00,UP=43,WARN=14,DOWN=3
_time=2019-09-25T15:42:34.000+02:00,UP=45,WARN=12,DOWN=3

UP,WARN and DOWN values are a count of "status" (UP,WARN and DOWN) at _time (these results are retrieved through REST API sourcetype, so I cannot change anything at the indexing level)

I would like to build a graph showing "status" by _time

Unfortunately, it seems that a timechart can only be built based on some count() or avg() or sum() ... etc but since my values are already a count, what can be my options here? All my tries led to displaying incorrect data 😞

Thank you in advance!

[jacobpevans · Accepted solution]

Greetings @it_systems,

You need to use an aggregate function for timechart to work properly. There is no way around that. In your case, you'd want sum(). If you want to keep the same values - since your data points are 1 minute apart, use span=1m to force that. Here's a run-anywhere search so you can see what I mean (run it for the last 5 minutes):

           | makeresults | eval _time=now()-  0, UP=45, WARN=12, DOWN=5
| append [ | makeresults | eval _time=now()- 60, UP=43, WARN=14, DOWN=3 ]
| append [ | makeresults | eval _time=now()-120, UP=45, WARN=12, DOWN=3 ]
| append [ | makeresults | eval _time=now()-180, UP=0,  WARN=10, DOWN=20 ]
| append [ | makeresults | eval _time=now()-240, UP=50, WARN=50, DOWN=50 ]
| timechart span=1m sum(DOWN) as DOWN, sum(UP) as UP, sum(WARN) as WARN

[it_systems]

Thanks @jacobevans !

That did the trick 🙂

Thank you very much for your help!

[jacobpevans]

You're welcome! Thank you for accepting the answer.