I am indexing some data in json format. The json has some fields that are arrays like:
{
system: "peanuts",
location: "california",
size: 12345
keywords: ["apples", "oranges", "bananas"]
}
I get around 500,000 events like this per day. It seems weird, but the size is attributed to each keyword completely such that stats sum(size) by keywords should give apples:12345, oranges:12345, bananas:12345.
To chart this, I might say "index=foo | mvexpand keywords{} | rename keywords{} as keywords| stats sum(size) as Total by keywords" with a time range of "past 60 minutes". I display this as a bar chart.
My boss likes this chart, but now he wants to see how today's totals compare with what we "normally" see. And he wants to be able to tell "at a glance" if today's totals deviate by too much (say if today's value at a given hour is >25% of normal or < 25% of normal). (possibly by changing the color of the graph for that section?)
I know this is possible, but I am not sure where to start to make it happen. How do I display two searches that search over different time frames on the same timechart? Should I use summary indexing to speed up the searches? Once I have the timechart, can I use simple XML dashboard to "highlight" sections/periods that are outside the acceptable range?
