Track License Usage Cumulatively, Comparing Last 7 Days

[aferone]

I would like to chart license usage throughout the day cumulatively, meaning, the results are added and charts every 5 minutes. So the chart would basically be a graph on a steady incline going up from left to right.

This is the search I am attempting, but the timewrap function is adding the previous days results to the next day.

index=_internal host=host source="*license_usage.log" type!=RolloverSummary earliest=-3d@d latest=+1d@d | timechart span=5m sum(b) as total | streamstats global=f sum(total) as accu_total | timewrap d

If I remove the timechart function, the current day results look fine. But when I add timechart, it doesn't work how I want it to.

Also, I need the accu_total, but a second line is generated called "total". How do I remove that line?

Thoughts? Thanks!

[javiergn]

Hi, take a look at the picture below and let me know if that's what you are looking for.
If not please provide a graph explaining what it is exactly what you need as I'm not 100% sure yet.
Keep in mind I don't have production data available and therefore I had to generate license usage with the variables minute, hour, day that you can ignore if you want.

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-2d@d   
| bin _time span=5m 
| stats latest(b) AS b by pool, _time 
| timechart span=5m sum(b) AS total fixedrange=false
| eval minute = strftime(_time, "%M")
| eval hour = strftime(_time, "%H")
| eval day = strftime(_time, "%d")
| eval total = coalesce(total, pow(day,6)*hour*minute)
| fields - day, hour, minute
| eval date = strftime(_time, "%Y-%m-%d")
| streamstats global=f sum(total) as accu_total by date
| eval total = round(total/1024/1024/1024, 3)
| eval accu_total = round(accu_total/1024/1024/1024, 3)
| fields - date

Output (see picture)

[aferone]

I am actually looking for something like what timewrap provides. A line chart that overlaps each day on top of each other, so you can easily compare each day.

I decided to check the license and dump it to a summary index and chart on that.

Thanks for your help!

[jeck11]

Aferone - Can you explain what you ended up coming up with?

[aferone]

index=summary source="License - License Progress Today (Populate Summary Index)" earliest=-3d@d latest=+1d@d 
| timechart span=5m values(GB) 
| rename values(GB) as GB
| timewrap d
| rename GB_latest_day as Today GB_1day_before as "1 Day Ago" GB_2days_before as "2 Days Ago" GB_3days_before as "3 Days Ago"

I check our license usage overall every 5 minutes and add it to a summary index. Then I use the above search to display the results.

[javiergn]

What about this?

index=_internal source=*license_usage.log type="Usage" earliest=-7d@d latest=@d
| bin _time span=5m 
| stats sum(b) as total by _time
| streamstats global=f sum(total) as accu_total

[aferone]

I may have forgotten to add that every day should be a new line so we can compare them.

[javiergn]

I can't test this right now, but what about this other one:

index=_internal source=*license_usage.log type="Usage" earliest=-7d@d latest=@d
| bin _time span=5m
| eval date = strftime(_time, "%Y-%m-%d")
| stats sum(b) as total by _time, date
| streamstats global=f sum(total) as accu_total by date

[aferone]

The line isn't stacked. It starts over for each day, but it is one continuous line.

And the "total" line is still there.

I really appreciate your help. Thank you.