My stats command is working, but when I pump it into timechart, it shows null values for fraction:
index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST, max(_time) as _time | eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction)
Any idea what I am missing here?
Thanks
You'll need a "by-clause" in the stats or timechart command. BY _time
not AS _time
. One creates a column, the other creates a row.. Timechart is looking for columns by rows of time.
Try these:
index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST, max(_time) as _time | eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction) by _time
index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST, max(_time) as maxtime by _time | eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction)
index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST by _time | eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction) max(_time)
Wait, why are we getting max(_time)? Anytime you manipulate _time you cause problems. Problems that can be fixed but i'm just trying to understand why you need the maximum thereof.