after bucketing, how to search/look for a threshold?

[tedder]

The following tells me how many events I'm indexing every 5 minutes.

index="_internal" group="thruput" | bucket _time span=5m | timechart span=5m sum(instantaneous_eps) as ieps

I'd really like to finish this with a threshold, like this:

index="_internal" group="thruput" | bucket _time span=5m | timechart span=5m sum(instantaneous_eps) as ieps | ieps < 5000

..except that doesn't work.

[Lowell · Accepted solution]

First off, you don't need "bucket" when you are using timechart. You really only need "bucket" when you are using "chart" or "stats" and you need to do something fancy that you can't do with "timechart" out of the box; which is pretty rare.)

Looks like a "where" is all you are missing. Try this:

index="_internal" group="thruput" | timechart span=5m sum(instantaneous_eps) as ieps | where ieps < 5000

You can technically use a "where" clause directly in your timechart command, but you have to use a split-by clause for this to work. (I'm not 100% sure what the advantage is to doing this over simply using the where search command, but it's a viable option in any case.)

index="_internal" group="thruput" | timechart span=5m sum(instantaneous_eps) as ieps by host where ieps < 5000