Getting Data In

How to graph with multiple fields by _time

it_systems
New Member

Hey community,

Browsed a lot of posts, but did not found any answer to my problem...

I have a sourcetype that give me this kind of results for a row, here is 3 exemples :

_time=2019-09-25T15:40:34.000+02:00,UP=45,WARN=12,DOWN=5
_time=2019-09-25T15:41:34.000+02:00,UP=43,WARN=14,DOWN=3
_time=2019-09-25T15:42:34.000+02:00,UP=45,WARN=12,DOWN=3

UP,WARN and DOWN values are a count of "status" (UP,WARN and DOWN) at _time (these results are retrieved through REST API sourcetype, so I cannot change anything at the indexing level)

I would like to build a graph showing "status" by _time

Unfortunately, it seems that a timechart can only be built based on some count() or avg() or sum() ... etc but since my values are already a count, what can be my options here? All my tries led to displaying incorrect data 😞

Thank you in advance!

0 Karma
1 Solution

jacobpevans
Motivator

Greetings @it_systems,

You need to use an aggregate function for timechart to work properly. There is no way around that. In your case, you'd want sum(). If you want to keep the same values - since your data points are 1 minute apart, use span=1m to force that. Here's a run-anywhere search so you can see what I mean (run it for the last 5 minutes):

           | makeresults | eval _time=now()-  0, UP=45, WARN=12, DOWN=5
| append [ | makeresults | eval _time=now()- 60, UP=43, WARN=14, DOWN=3 ]
| append [ | makeresults | eval _time=now()-120, UP=45, WARN=12, DOWN=3 ]
| append [ | makeresults | eval _time=now()-180, UP=0,  WARN=10, DOWN=20 ]
| append [ | makeresults | eval _time=now()-240, UP=50, WARN=50, DOWN=50 ]
| timechart span=1m sum(DOWN) as DOWN, sum(UP) as UP, sum(WARN) as WARN
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

0 Karma

jacobpevans
Motivator

Greetings @it_systems,

You need to use an aggregate function for timechart to work properly. There is no way around that. In your case, you'd want sum(). If you want to keep the same values - since your data points are 1 minute apart, use span=1m to force that. Here's a run-anywhere search so you can see what I mean (run it for the last 5 minutes):

           | makeresults | eval _time=now()-  0, UP=45, WARN=12, DOWN=5
| append [ | makeresults | eval _time=now()- 60, UP=43, WARN=14, DOWN=3 ]
| append [ | makeresults | eval _time=now()-120, UP=45, WARN=12, DOWN=3 ]
| append [ | makeresults | eval _time=now()-180, UP=0,  WARN=10, DOWN=20 ]
| append [ | makeresults | eval _time=now()-240, UP=50, WARN=50, DOWN=50 ]
| timechart span=1m sum(DOWN) as DOWN, sum(UP) as UP, sum(WARN) as WARN
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

0 Karma

it_systems
New Member

Thanks @jacobevans !

That did the trick 🙂

Thank you very much for your help!

0 Karma

jacobpevans
Motivator

You're welcome! Thank you for accepting the answer.

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!