How to build a timechart that shows overall (n+1) capacity and per site visibility?

[burras]

I'm attempting to develop a chart for one of my engineering teams that shows peak utilization across multiple sites over a given timeframe with an overlay showing (n+1) capacity. That part was easy enough to build:

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval "(n+1) Capacity" = 80

The issue has come in where they no longer want a static capacity line. They are adding new nodes to the system and want the (n+1) capacity line to change automatically to account for new node adds but also reflect when changes were made in the past (i.e. if there are 4 nodes today then capacity=80, when they add a node tomorrow capacity becomes 83). After several iterations of playing around, I've been able to get it to calculate the right capacity line but can only get it to display overall max utilization, not broken down by site:

index=foo sourcetype=bar Site!=Other | stats max(util), dc(Site) as n by _time |eval capacity=(n/(n+1)*100) |fields - n

Any advice on how to format this in order to display the capacity line for all Sites over time along with the max utilization per Site?

[somesoni2 · Accepted solution]

Give this a try

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,n+1) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

Updated

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,if('<<FIELD>>'>0,n+1,n)) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

[burras]

Beautiful, that updated answer was the one. Appreciate the help!

[burras]

That mostly works - it breaks out each Site's max utilization individual but it doesn't show the change in capacity over time. It just shows the "(n+1) Capacity" as a static line over the searched timeframe instead of changing when the count of nodes changes.

[burras]

To clarify - the n+1 capacity line that it shows over the whole searched period is that last n+1 data for the period instead of showing 66 when I have 3 nodes, 80 when I have 4 nodes, 83 when I have 5 nodes. This would be cake if the eval command allowed you to use dc(Site) as part of the command 🙂

[somesoni2]

Try the updated answer.