Sum value from distinct hosts over time

[caviman2201]

I have a bunch of hosts streaming logs that show metrics like cpu count. The problem is that they all send those logs at different times. I'm trying to calculate perform math on the aggregate metrics, but everything is wrong because I can't figure out how to perform math on the values from distinct hosts. I've searched for deduping on a span and got nowhere. Logs look something like this:

1:00:01 - ip=192.168.1.5 cpu_count=8
1:00:01 - ip=192.168.1.6 cpu_count=8
1:00:02 - ip=192.168.1.7 cpu_count=8
1:00:03 - ip=192.168.1.8 cpu_count=8
1:00:03 - ip=192.168.1.7 cpu_count=8
1:00:03 - ip=192.168.1.5 cpu_count=8
1:00:03 - ip=192.168.1.6 cpu_count=8
1:00:04 - ip=192.168.1.7 cpu_count=8
1:00:04 - ip=192.168.1.8 cpu_count=8

what i want to do is something like | dedup span=1m by ip | eval TotalPercent = cpu_count * 100 | timechart sum(TotalPercent) AS TotalAvailableCPUPercent

hope that makes sense

[Ayn · Accepted solution]

You probably want bucket for grouping your events by time and deduping on that.

... | bucket _time span=1m | dedup _time ip | eval TotalPercent = cpu_count * 100 | chart sum(TotalPercent) AS TotalAvailableCPUPercent over _time