Add field to timechart

[schufi01]

Hi,

I got a timechart that shows the number of critical package losses per day. Additionally I calculate the average of critical package losses within the chosen timespan and show it as a straight line in the timechart. Now I would like to add a line, that tells me, how many different hosts were used on every single day. (E.g Monday 36, Tuesday 64, Wednesday 55, ...)

Thats the code that calculates the number of critical package losses per day and the average within the chosen timespan.

| eval Amount= numberLostPackages
| timechart span=24h count(Amount) as Count sum(Amount) as Total aligntime=@d
| eventstats sum(Count) as TotalCount
| addinfo 
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration

[jodonald · Accepted solution]

Hi @schufi01 

Using the distinct_count() function in your timechart will give you the number of different hosts each day.  so your search would look like this:

| eval Amount= numberLostPackages
| timechart span=24h count(Amount) as Count sum(Amount) as Total distinct_count(host) as unique_hosts aligntime=@d
| eventstats sum(Count) as TotalCount
| addinfo 
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration

Additionally, you can modify the span to align on days instead of hours which would allow for you to drop the aligntime from your timechart.  so the final search would look like this:

| eval Amount= numberLostPackages
| timechart span=1d count(Amount) as Count sum(Amount) as Total distinct_count(host)
| eventstats sum(Count) as TotalCount
| addinfo 
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration

Hope that helps.