Getting Data In

How to graph with multiple fields by _time

New Member

Hey community,

Browsed a lot of posts, but did not found any answer to my problem...

I have a sourcetype that give me this kind of results for a row, here is 3 exemples :

_time=2019-09-25T15:40:34.000+02:00,UP=45,WARN=12,DOWN=5
_time=2019-09-25T15:41:34.000+02:00,UP=43,WARN=14,DOWN=3
_time=2019-09-25T15:42:34.000+02:00,UP=45,WARN=12,DOWN=3

UP,WARN and DOWN values are a count of "status" (UP,WARN and DOWN) at _time (these results are retrieved through REST API sourcetype, so I cannot change anything at the indexing level)

I would like to build a graph showing "status" by _time

Unfortunately, it seems that a timechart can only be built based on some count() or avg() or sum() ... etc but since my values are already a count, what can be my options here? All my tries led to displaying incorrect data 😞

Thank you in advance!

0 Karma
1 Solution

Motivator

Greetings @it_systems,

You need to use an aggregate function for timechart to work properly. There is no way around that. In your case, you'd want sum(). If you want to keep the same values - since your data points are 1 minute apart, use span=1m to force that. Here's a run-anywhere search so you can see what I mean (run it for the last 5 minutes):

           | makeresults | eval _time=now()-  0, UP=45, WARN=12, DOWN=5
| append [ | makeresults | eval _time=now()- 60, UP=43, WARN=14, DOWN=3 ]
| append [ | makeresults | eval _time=now()-120, UP=45, WARN=12, DOWN=3 ]
| append [ | makeresults | eval _time=now()-180, UP=0,  WARN=10, DOWN=20 ]
| append [ | makeresults | eval _time=now()-240, UP=50, WARN=50, DOWN=50 ]
| timechart span=1m sum(DOWN) as DOWN, sum(UP) as UP, sum(WARN) as WARN
Cheers,
Jacob

View solution in original post

0 Karma

Motivator

Greetings @it_systems,

You need to use an aggregate function for timechart to work properly. There is no way around that. In your case, you'd want sum(). If you want to keep the same values - since your data points are 1 minute apart, use span=1m to force that. Here's a run-anywhere search so you can see what I mean (run it for the last 5 minutes):

           | makeresults | eval _time=now()-  0, UP=45, WARN=12, DOWN=5
| append [ | makeresults | eval _time=now()- 60, UP=43, WARN=14, DOWN=3 ]
| append [ | makeresults | eval _time=now()-120, UP=45, WARN=12, DOWN=3 ]
| append [ | makeresults | eval _time=now()-180, UP=0,  WARN=10, DOWN=20 ]
| append [ | makeresults | eval _time=now()-240, UP=50, WARN=50, DOWN=50 ]
| timechart span=1m sum(DOWN) as DOWN, sum(UP) as UP, sum(WARN) as WARN
Cheers,
Jacob

View solution in original post

0 Karma

New Member

Thanks @jacobevans !

That did the trick 🙂

Thank you very much for your help!

0 Karma

Motivator

You're welcome! Thank you for accepting the answer.

Cheers,
Jacob
0 Karma