Timechart/chart for getting the count of events with specified field value

[macadminrohit]

Hi ,

I want a graph which actually gives me a ratio of count of events by host grouped together in a 15 minute interval for last 24 hours.

I have written a query like this index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | chart span=15m count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST

This gives me a graph, but i want the bars(for each host) to be grouped together for every 15 minutes interval. Any thoughts??

[adonio · Accepted solution]

the timechart needs the _time field, you are stripping it with your stats try to add it after the by clause
as a side note, no need to rename here and in general, try to do so (and other cosmetics) at the end of the query for better performance. lastly, the function is values not value
try this:

index=servers sourcetype=xs_json Name=web url=www.google.com/something 
| stats  count(eval(dby.msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(bdy.msg="HttpRequest")) as REQUEST by host _time
 | eval Ratio=EXCEEDED/REQUEST 
 | timechart span=15m values(Ratio) by host 

hope it helps

[ssadanala1]

Please use trellis visualization to accomplish the requirement

[macadminrohit]

I want time to be on X-axis and ratio on y-axis. with the above query I am getting host on x-axis and Ratio on y.

Also when I use the below query it doesn't give any stats :

index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | stats  count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST | timechart value(Ratio) by host