Help with transaction search

[briang67]

Hello,

I have a file that looks like the following:

date1 node1 seq_13 seq13_total_time

date1 node1 seq_12 seq12_total_time

date1 node1 seq_11 seq11_total_time

date1 node1 seq_10 seq10_total_time

date2 node2 seq_13 seq13_total_time

date2 node2 seq_12 seq12_total_time

date2 node2 seq_11 seq11_total_time

date2 node2 seq_11 seq11_total_time

date3 node3 seq_13 seq13_total_time etc...

The fields are named date, node, seq_num, and seq_total_time. The date changes with the new reporting node. Seq_total_time represents a transaction time in seconds.

I'm trying to create a mutiseries timechart where on the Y axis is seconds. For the data points I need to avg all of the seq_total_times reported by each individual node for a given seq_num and time. I would have multiple data points for each time slot (1 hour) representing the avg for each seq_num.

I think I need to use a transaction for this - but I'm not sure of how to format the search. Can anyone help to provide a few ideas?

Thank you

[gkanapathy]

You don't need to (and therefore should not) use transaction. Perhaps your solution is as simple as:

source=my_data | timechart avg(seq_total_time) by seq_num

But another interpretation is:

source=my_data | eval nseq=node."--".seq_num | timechart avg(seq_total_time) by nseq