My scheduled search:
[Summary Logins Per Second]
action.summary_index = 1
action.summary_index._name = lgn-stats
cron_schedule = 10 5-17 * * 1-5
dispatch.earliest_time = -15m@m
dispatch.latest_time = -5m@m
displayview = flashtimeline
enableSched = 1
realtime_schedule = 0
request.ui_dispatch_view = flashtimeline
search = SYSCODE=LGN-* | sitop _time
vsid = gc6frvm6
After running through a few cycles this morning, I ran this search:
index=lgn-stats search_name="Summary Logins Per Second" | top _time
Our app is particularly busy at the top of the hour. I'm trying to grab the busiest seconds at the top 10 minutes of every hour (X:55:00 - Y:05:00) for monthly reporting. However, the SI search above is returning total events for the entire 10 minutes as the top entries, followed by the top seconds that I really want. Example:
time count percent
1 8/2/10 5:55:00.000 AM 55770 inf
2 8/2/10 6:55:00.000 AM 34025 inf
3 8/2/10 4:55:00.000 AM 24479 inf
4 8/2/10 5:56:59.000 AM 155 inf
5 8/2/10 6:00:05.000 AM 144 inf
6 8/2/10 5:58:40.000 AM 137 inf
7 8/2/10 5:59:30.000 AM 136 inf
8 8/2/10 5:58:42.000 AM 134 inf
9 8/2/10 6:00:12.000 AM 131 inf
10 8/2/10 5:59:25.000 AM 128 inf
Apparently I've misunderstood something basic about the SI command set. Any tips?
Thanks, Jon
I think the search you want is:
SYSCODE=LGN-* | timechart count span=1s
This will return the # of matching events in 1 second buckets, or whatever bucket you want. Try it without the si. You can sort it by count to find the 'second' that has the most events.
If it works then just tack on the sitimechart and use that recurring search to fill your summary.
SYSCODE=LGN-* | sitimechart count span=1s
I think the search you want is:
SYSCODE=LGN-* | timechart count span=1s
This will return the # of matching events in 1 second buckets, or whatever bucket you want. Try it without the si. You can sort it by count to find the 'second' that has the most events.
If it works then just tack on the sitimechart and use that recurring search to fill your summary.
SYSCODE=LGN-* | sitimechart count span=1s
Yeah, that's what I've ended up doing. I was trying avoid large result collections, only wanting to keep the top X results each time. (Not exactly what I wanted, but good enough for a check mark.)
Thanks!