Can you help me chart how many users are connecting to a certain application?

[richard_temple]

I am collecting the logs for an application and I'm trying to chart how many users are connecting to it over time. My problem is that there can be multiple application instances running, each producing it's own log file with the number of users connected to that specific application.

Here is an example where two instances of the application have been spawned and are producing two log files.

59544899.log
2018/09/18 09:34:46:351 : Initialization complete, instances in JVM = 2
2018/09/18 09:44:16:885 : Initialization complete, instances in JVM = 3

36305003.log
2018/09/18 09:39:43:720 :  shutdown, remaining instances in JVM = 10
2018/09/18 09:43:16:593 :  Initialization complete, instances in JVM = 11

In this example, I have been able to produce two charts which show the number of users over time. But how would I go about combining the values to produce a single, total usage count over time ?

[jgbricker]

I can take a shot at what you are looking for but I don't think I have enough information. Are the log files of interest sharing a common index or source type (I would assume so). Based on your description I understand that you want the total users on all instances within a give time bucket.

you could do something like the below which assumes you have the number in the logs extracted as user_volume

index=yourIndex sourcetype=yourSourcetype |timechart span=1h sum(user_volume) as total_users