Hi,
I have a script which gets value for a KPI for each 4 min.
10/9/15
8:44:00.000 AM
KpiId="4185"|kpiName="DocStats.TotalCount: $Host.HostName, $IntegrationServer.Port, $TNServer.Name"|Host.HostName="xxxx.com"|TNServer.Name="TNServer"|IntegrationServer.Port="xxxx"|date="2015-10-09T08:44:00Z"|value="4440407.0"
10/9/15
8:48:00.000 AM
KpiId="1824"|kpiName="DocStats.TotalCount: $Host.HostName, $IntegrationServer.Port, $TNServer.Name"|Host.HostName="xxxx.com"|TNServer.Name="TNServer"|IntegrationServer.Port="xxxx"|date="2015-10-09T08:48:00Z"|value="6792796.0"
10/9/15
8:52:00.000 AM
KpiId="4188"|kpiName="DocStats.TotalCount: $Host.HostName, $IntegrationServer.Port, $TNServer.Name"|IntegrationServer.Port="xxxx"|TNServer.Name="TNServer"|Host.HostName="xxxx.com"|date="2015-10-09T08:52:00Z"|value="4463853.0"
I just want to select event value at each hour. How can I do that ?
Thanks.
You can do it like this :
... date_minute=0 | table _time value
But you would probably be better off doing an average over the hour like this:
... | timechart span=1h avg(value)
You can do it like this :
... date_minute=0 | table _time value
But you would probably be better off doing an average over the hour like this:
... | timechart span=1h avg(value)
The value I am getting is cumulative value. I want to find the difference between values at each hour so that I can find out how many requests are processed during the hour.
Like this:
... | timechart span=1h count(value) AS numRequestsThisHour
Or:
... value=* | timechart span=1h dc(hosts) AS hostsWithRequestsThisHour