Do you mean to say that some periods have no data about pods? (Or rather, no data about pods with importance value "non-important".) My initial suggestion was based on the assumption that during any...
See more...
Do you mean to say that some periods have no data about pods? (Or rather, no data about pods with importance value "non-important".) My initial suggestion was based on the assumption that during any given interval, there are some pods. Now that I think about it, it is possible that that assumption is still true but some intervals may only get important pods and all non-important ones are missing. Try this index=abc sourcetype=kubectl importance=non-critical
| lookup pod_list pod_name_lookup as pod_name OUTPUT pod_name_lookup
| dedup pod_name
| where sourcetype == "kubectl"
| timechart span=1m@m values(pod_name_lookup) as pod_name_lookup values(pod_name_all) as pod_name_all
| append
[makeresults format=csv data="namespace, pod_name_lookup, importance
ns1, kafka-*, critical
ns1, apache-*, critical
ns2, grafana-backup-*, non-critical
ns2, someapp-*, non-critical"
| where importance = "non-critical"
``` subsearch thus far emulates
| inputlookup pod_list where importance = non-critical
```
| rename pod_name_lookup as pod_name_all]
| eventstats values(pod_name_all) as pod_name_all
| eval missing = if(isnull(pod_name_all), pod_name_all, mvappend(missing, mvmap(pod_name_all, if(pod_name_all IN (pod_name_lookup), null(), pod_name_all))))
| where isnotnull(missing)
| timechart span=1m@m count by missing Exactly the same idea, just fill intervals with no non-important pod groups. Those intervals will see all pod groups marked as missing.