timechart + sort limiting number of samples?

[talbot7]

Trying to show the top 10 busiest guest VM's in mu environment.
Each guest VM is reporting its network status in the following syntax:

Apr  5 13:41:22 a4-hpc1-2 logger: xen-performance network42 : timestamp=13:41:21 pool=General1 hardware=a4-hpc1-2 guest=9895_splatqa0006_RX interface=vif8.0 bytes=0133071 MBytes=0.12

Every 20 seconds I get a status update, and how much data was transmitted in the last 20sec. When I use the following search, I can get status of most VM's.

index=performance network42 MBytes | eval MB = MBytes/20 | timechart max(MB) span=60s by guest usenull=f useother=f

The problem comes in when I try to sort the data.

index=performance network42 MBytes | eval MB = MBytes/20 | timechart max(MB) span=60s by guest usenull=f useother=f | sort num(MB) by guest limit=7

The limit on sort seems to be applying to the number of samples, not the number of guests.

Ideas?

[Stephen_Sorkin · Accepted solution]

First, you can simplify the timechart part by using per_second to sum the MB, and divide by 60, for example:

index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f

If you want to find the top ten spikes over a 60s period, you'd sort:

index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f | sort 10 MBpersecond

If you wanted to look for the busiest hosts, globally, you wouldn't use timechart at all:

index=performance network42 MBytes | stats sum(MBytes) as MBtotal by guest  | sort 10 MBtotal