Max of Distinct Count

[pontorito]

I am trying to get a distinct count of two concatenated numbers and then get the max of that distinct count over a time period. My current search works up until the last pipe. I can get the distinct count but not the max of the distinct count. Any help is appreciated!

index=x heartbeat AssetType=Linear
|bucket span=1m _time | eval DistinctSession=XDI.AssetID
| timechart span=1m dc(DistinctSession) as ConcurrentSession by DeviceType
| timechart span=1d max(ConcurrentSession) by DeviceType

[somesoni2]

Give this a try

index=x heartbeat AssetType=Linear |bucket span=1m _time | eval DistinctSession=XDI.AssetID | timechart span=1m dc(DistinctSession) as ConcurrentSession by DeviceType | timechart span=1d max(*) by *

[Ledion_Bitincka]

Can you describe what you want the timechart to look like? I'd guess there will be two series: one showing the distinct count, hourly and another showing the max at the daily granularity?

[pontorito]

I'm trying to distinct count per minute, and then I want the max of those distinct counts per day. Basically I want one number per day - the max value of those per minute counts. A little confusing, I know. 🙂

[martin_mueller]

I'd guess the first timechart assigns one column for each value of DeviceType, so the second timechart doesn't find any column named DeviceType. Try this instead:

index=x heartbeat AssetType=Linear | rename XDI.AssetID as  DistinctSession
| bucket span=1m _time | stats dc(DistinctSession) as ConcurrentSession by _time DeviceType
| timechart span=1d max(ConcurrentSession) by DeviceType

[martin_mueller]

Do the values look right when you leave off the timechart?

index=x heartbeat AssetType=Linear | rename XDI.AssetID as  DistinctSession
| bucket span=1m _time | stats dc(DistinctSession) as ConcurrentSession by _time DeviceType

[pontorito]

this is close...the DeviceType field is now showing up but I still can't get a max number. For some reason the dc isn't being pulled into the timechart function to compute a max