I'm having trouble computing an aggregate performance indicator.
The following expression (which has the goal to obtain a value up to 100 to feed a radial gauge ) is working,
index=resources_reporting source="*/output/ora_queries/client07/OS_metrics.csv"
| fields USED_CPU HOST_NAME
| eval Platform = case(
HOST_NAME like "%scp%" AND NOT (HOST_NAME like "%dscp%"), "SCPs",
HOST_NAME like "%dscp%", "DSCPs",
...
HOST_NAME like "%mgr%", "MGRs"
)
| eval OptimumCpu = case(
Platform=="SCPs" AND USED_CPU <= 60, 1,
Platform=="DSCPs" AND USED_CPU <= 60, 1,
...
Platform=="MGRs" AND USED_CPU <= 60, 1
)
| eval AcceptableCpu = case(
Platform=="SCPs" AND USED_CPU > 60 AND USED_CPU <= 75, 1,
Platform=="DSCPs" AND USED_CPU > 60 AND USED_CPU <= 75, 1,
...
Platform=="MGRs" AND USED_CPU > 60 AND USED_CPU <= 75, 1
)
| stats count(USED_CPU) as TotalEvents sum(OptimumCpu) as TotalOptimumCpu sum(AcceptableCpu) as TotalAcceptableCpu by Platform
| fillnull
| eval ScpCpu=if(Platform="SCPs",(TotalOptimumCpu + TotalAcceptableCpu/2) / TotalEvents,0)
| eval DscpCpu=if(Platform="DSCPs",(TotalOptimumCpu + TotalAcceptableCpu/2) / TotalEvents,0)
...
| eval MgrCpu=if(Platform="MGRs",(TotalOptimumCpu + TotalAcceptableCpu/2) / TotalEvents,0)
| eval ApdexScore=round(100*(0.17*ScpCpu + 0.17*DscpCpu + ... + 0.04*MgrCpu),2)
| stats sum(ApdexScore) as TotalApdexScore
which returns something like 99.96,
however I'm missing why I can't get the correponding aggregate time evolution in a line chart, replacing the last line with,
| timechart (ApdexScore) as TotalApdexScore
which returns
No results found.
What should I change to get a timechart of my ApdexScore expression ?
Hi splunk_zen, looking at your query, it seems that you are not bringing the _time
field to the point when you need it. Add the _time
field to the end of your | stats
pipes.
Hi splunk_zen, looking at your query, it seems that you are not bringing the _time
field to the point when you need it. Add the _time
field to the end of your | stats
pipes.
just did that, go ahead and accept it 😉
So simple...
Thanks !
I'll accept your comment as an answer if you promote it.