I have a metric index reflecting the OS kpis (unix nmon tool).
In order to process the data with ML algorithms, I would like to extract it in the following form:
_time, metric1, metric2, ...., metricN, host
At the moment it is in the form:
time, metricname, host
I extract it with the following search:
| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name=* groupby metric_name, host span=1m
How would the search command have to look like to achieve my goal?
Also, the second question is how can I exclude metrics with a specific name pattern from the search? I tried with the following:
| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name!= "*cpunn*" groupby metric_name, host span=1m
... but the above does not get accepted throwing error:
Error in 'mstats' command: Missing metricname filter after 'WHERE' keyword. For performance reason, only search on a subset of metricnames are allowed.
Can you please check **** section in below doc?'
Description: An expression describing the filters that are applied to your search. Includes time and search modifiers, comparison expressions, and index expressions. See the following sections for descriptions of each of these logical expression components. **Cannot filter on metric_name**. Does not support CASE or TERM directives. You also cannot use the WHERE clause to search for terms or phrases.