- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how to calculate the device’s uptime value e.g time delta means time between (uptime < 1800) up to next (uptime < 1800). (note: if the next uptime is not found then just calculate time up to end period).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perhaps this will get you started.
index=foo "uptime"
| rex "uptime\"\":(?<uptime>\d+)"
| where uptime < 1800
| streamstats window=2 range(_time) as delta
| table _time uptime deltaIf this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you share some sample data?
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2020-07-14 06:43:37.0,0,ERROR,000000000000,na,na,na,na,na,na,na,na,"""na""",na,na,"{""bootid"":0,""deviceid"":""BC10164B002952"",""mac"":""9021063d8898"",
""payload"":{""CPU"":[2,9,85],""Mem"":[253360,124120],""CmsLock"":{""PID"":0,""Dur"":0,""PName"":""NULL"",""Fn"":""NULL""},""IFStat"":{""eth0.1"":[320838754,252147895],
""br0"":[413300414,21771493],""wl1"":[0,430467720],""wds1.2"":[51152432,2323764265],""wl0"":[437899257,6876453],""wds1.1"":[580685048,116947992],""eth0"":[3680810744,927584233]},
""Eth"":{""0"":{""Type"":""100baseTx-FD."",""LinkUp"":1}},,""Temp"":[45,62]},""model"":""EE120"",""region"":""UK"",""resetid"":""FIRM_FUS"",""sw"":""2.20.2747.R"",
""topic"":""HCTELEM"",""uptime"":271031,""utc"":1594705390,""vc"":""na"",""wakereason"":""na"",""ver"":2}"
this is basically raw data. here uptime is 271031. so we want devices uptime value which are less than 1800. by calculating time delta (uptime < 1800) up to next (uptime < 1800). (note: if the next uptime is not found then just calculate time up to end period).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perhaps this will get you started.
index=foo "uptime"
| rex "uptime\"\":(?<uptime>\d+)"
| where uptime < 1800
| streamstats window=2 range(_time) as delta
| table _time uptime deltaIf this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for that.
there are few more requirements. Below are some of them.
• Take the memory data (freemem) from the first point and just BEFORE the next point at where the device was rebooted.
• Show the device uptime based on time calculation between the two points.
• Calculate the delta of memory (freemem) between the two points.
Reboot can be recognized by resetid
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Finding an event immediately before another event is a challenge I've not yet overcome.
If this reply helps you, Karma would be appreciated.
