I have log data that tracks the completion of jobs. I'd like to be able to track the completed jobs, but for 4 different increments: the last 5 minutes, last 30 minutes, last hour, and last 24 hours, and I'd like it to be displayed in a table, something like this.
JobType | 5mins | 30mins | 60mins | 24hrs
AA 2 30 100 150
BB 0 10 20 30
And the data resembles something like this:
<timestamp> JobType=AA status=Finished
<timestamp> JobType=BB status=Finished
I can do a count on status=Finished and dump that to a simpleResultsTable by JobType for the entire log file or for a single start/end period. But how would I send that to a simpleResultsTable for multiple increments?
You should be able to use eval and relative_time to sort this one out:
status=Finished
| stats sum(eval(if(_time > relative_time(now(), "-5m"),1,0))) as 5mins,
sum(eval(if(_time > relative_time(now(), "-30m"),1,0))) as 30mins,
sum(eval(if(_time > relative_time(now(), "-60m"),1,0))) as 60mins,
sum(eval(if(_time > relative_time(now(), "-24h"),1,0))) as 24hrs by JobType
Let me know if that works.
You should be able to use eval and relative_time to sort this one out:
status=Finished
| stats sum(eval(if(_time > relative_time(now(), "-5m"),1,0))) as 5mins,
sum(eval(if(_time > relative_time(now(), "-30m"),1,0))) as 30mins,
sum(eval(if(_time > relative_time(now(), "-60m"),1,0))) as 60mins,
sum(eval(if(_time > relative_time(now(), "-24h"),1,0))) as 24hrs by JobType
Let me know if that works.
Excellent! I'm glad to hear that.
Yes that works. Thanks!