vmstat , net stat is captured every minute. While access_combined has entires whenever traffic comes in (every second or more).
index=os sourcetype=vmstat host="tbbpapp1.xyz.com" |multikv
and loadAvg1mi gives me avg for that minute.
I want to take the _time from the above run the following search
index=tbb sourcetype="access_combined"|rex "10\.\d+\.\d+\.\d+\s(?P<source_ip>[\d+\.+]+)\s\[\d+"
So the basic idea is to tie load times with count of source_ips to arrive at # of http connections at _time and its corresponding load on the server.
i could easily do
sourcetype=access_combined OR sourcetype=vmstat |_time , but then i felt the extractions would get more complicated than they need to be.
sourcetype=access_combined OR sourcetype=vmstat |_time
You need the map command:
index=os sourcetype=vmstat host="tbbpapp1.xyz.com" | multikv | stats last(_time) as starttime| eval endtime=starttime+10 | map search="search earliest=$starttime$ latest=$endtime$ index=tbb sourcetype=\"access_combined\"|rex \"10\.\d+\.\d+\.\d+\s(?<source_ip>[\d+\.+]+)\s\[\d+\""