Reporting

how to plot a time chart with average of some fields for some devices

Explorer

Need to plot a time chart of some mac with average of Mem0, Mem1, CPU0, CPU1 and CPU2.

(index=metrics OR index=hc_trials OR index=hc_prod) (HCTELEM OR HCJUNK) uptime>1800
| fields + payload version deviceid mac uptime
| eval payload=replace(payload, "\"\"", "\"")
| spath input=payload output=Mem0 path=Mem{0}
| spath input=payload output=Mem1 path=Mem{1}
| spath input=payload output=CPU0 path=CPU{0}
| spath input=payload output=CPU1 path=CPU{1}
| spath input=payload output=CPU2 path=CPU{2}
| table mac Mem0 Mem1 CPU0 CPU1 CPU2

 

 

@thambisetty 

Labels (3)
0 Karma

Champion

you can change span=whateveryouwant , I have aggregated events to 10minutes

you can't actually plot 3 axis - _time, mac and averages on 2D graphs.

 

(index=metrics OR index=hc_trials OR index=hc_prod) (HCTELEM OR HCJUNK) uptime>1800
| fields + payload version deviceid mac uptime
| eval payload=replace(payload, "\"\"", "\"")
| spath input=payload output=Mem0 path=Mem{0}
| spath input=payload output=Mem1 path=Mem{1}
| spath input=payload output=CPU0 path=CPU{0}
| spath input=payload output=CPU1 path=CPU{1}
| spath input=payload output=CPU2 path=CPU{2}
| bin _time span=10m
| stats avg(Mem0) as avg_Mem0 avg(Mem1) as avg_Mem1 avg(CPU0) as avg_CPU0 avg(CPU1) as avg_CPU1 avg(CPU2) as avg_CPU2 by _time,mac

 

  

————————————
If this helps, give a like below.
0 Karma

Explorer

I need the average of only these devices 24A7DCFFB120,24A7DCFFB480,24A7DCFFB730,3C8994CCFB80,24A7DCFFBB30,24A7DCFFA150,80721552DB50,3C8994718568,24A7DCFFAB78,3C8994558170,807215405D08,3C8994782528,3C8994667D78,3C8994788B70,3C899467CBC8,3C8994731588,24A7DCFFA650,3C8994763F88,3C8994764D68

 

 

can i use a where 

| where mac like (24A7DCFFB120,24A7DCFFB480,24A7DCFFB730,3C8994CCFB80,24A7DCFFBB30,24A7DCFFA150,80721552DB50,3C8994718568,24A7DCFFAB78,3C8994558170,807215405D08,3C8994782528,3C8994667D78,3C8994788B70,3C899467CBC8,3C8994731588,24A7DCFFA650,3C8994763F88,3C8994764D68)

0 Karma

Explorer

Actually i need the average of (Mem0) ,(Mem1) ,(CPU0) ,(CPU1) &(CPU2) for these 21 devices aggregated

0 Karma

Explorer

something like this for all 21 devices aggregated on daily basis.

_timeavg_Mem0avg_Mem1avg_CPU0avg_CPU1avg_CPU2
01-08-2020288896777867698981232
02-08-2020287656875897696761342
03-08-2020265426543823197541423
04-08-2020265796231835495431876
Tags (2)
0 Karma