timechart with delta command using by clause

[abhayneilam]

Hi,

I have a query like :

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) as TOTAL1 | delta TOTAL1 as HERO | table _time HERO

I want my output as an area graph as a stacked graph but it should show CIA and FIA with the _time . I want to show _time in x-axis and in y it will be stacked graph for LIA and CIA. When I am modifying my query it is giving the straight line, it is not showing the ups and downs of the graph .

So please help me to use timechart command with by clause with multiple fileds using delta

[somesoni2 · Accepted solution]

Try this

If value for Name is ststic as CIA and FIA

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) by NAME| delta CIA  as HEROCIA | delta  FIA as HEREFIA | table _time HEROCIA HEROFIA

[somesoni2]

Try this for dynamic value of Name.

index=XXX sourcetype=YYY  AGE = "*" NAME="CIA" OR NAME="FIA" |bucket span=1h _time | stats sum(FIELD) as sum by _time,NAME|sort 0 _time| steamstats current=f window=1 first (sum) as prev by Name eval delta=sum - prev | xyseries _time Name delta

[martin_mueller]

Additionally, drop off the |search:

index=XXX sourcetype=YYY AGE = "*" (NAME="CIA" OR NAME="FIA") | timechart ...

[abhayneilam]

How to make a query if the Name is not static as CIA and FIA ..

index=XXX sourcetype=YYY |search AGE = "" NAME="" |timechart span=1h sum(FIELD) by NAME| delta.......

please help in this regards, If the value is known then it is ok with the above example, but if the value is not known then how to deal with this kind of situation ? please help !!

[abhayneilam]

Awesome, you are just awesome !! really very very much appreciated !!