About rpecka

rpecka · ‎08-15-2022

I would like to run a timechart query that ends with `| timechart span=1h distinct_count(thing) by other_thing` The problem is that there are a huge number of events being counted so the query takes a long time. Is there a way that I can run the same query but sample only the first 5 minutes of every hour so that I can speed up the query?

rpecka · ‎06-27-2022

I have rows in the form: ID Field1 Field2 Field3 And I would like to create a histogram that shows the values of all three fields. I can make one for Field1 by doing stats count by Field1 span=1000 but I can't seem to figure out how I would get the other values into the same table. Do I need to do multiple searches and join them? How would I go about doing that?

rpecka · ‎05-27-2022

I have events with stageIDs and IDs. I want to create one row for each ID which includes a column for each stageID to indicate whether it has or does not have a corresponding event for that stageID. Then I want to filter for only the rows (IDs) that have stageID=foo present, and then create a pie chart to count the occurrences of each stageID in the rows that remain

rpecka · ‎05-25-2022

This isn't quite it. When I run the chart command I get this table: sessionID stageID1 stageID2 stageID... id1 99 86 34 id2 33 45 22 I want the same thing except without the chart and with additional columns populated depending on what the stages are

rpecka · ‎05-18-2022

I have events which will all have an ID, stageID, stageDuration, as well as other information. In the past I've used `chart sum(stageDuration) over ID by stageID` to create stacked bar charts, but now I’m more interested in the table produced by that command. It has a column for ID, then columns for the durations of each of the stageIDs that had the same ID. I would like to create a similar table except I would like to include additional columns. For example, I would like to conditionally populate a column with event.startTime from the stage foo if the stageID foo exists for an ID. I don't need to visualization, just the way of forming the table. It seems like there might be a way to do this with transactions but I haven't been able to figure it out.

rpecka · ‎05-03-2022

You're right. What I’m trying to do is not as complicated as I thought it was. I only need to duplicate the case statement once to get what I need. Thank you!

rpecka · ‎04-27-2022

I would like to narrow down my results and rename a few fields using an initial search, let's call these results A. Then I want to take A and search on `event_type=event1` and massage the results to get B Then take A and search on `event_type=event2` and massage the results to get C Then I want to combine the results B and C and use chart to dedup and display the combined result. With my current query, the column for stage1 in my table is all null, but if I do the search with the contents of the append at the root and remove the second search, I get populated results My current query is the following: index=... ... | rename some_field as taskID | append [search "event.event_type"=event1 | eval stageDuration='event.payload.total_duration'-'event.payload.provisioning_duration' | eval stageID="stage1"] | search "event.event_type"=event2 | rename event.payload.total_duration as stageDuration event.payload.stageID as stageID | chart sum(stageDuration) over taskID by stageID | table taskID, stage1, * | where isnull(stage4) | fillnull value=0

rpecka · ‎04-25-2022

Hi, I’m trying to make a stacked bar chart visualization where my y axis is milliseconds, my x axis is a task ID, and I’m splitting by a stage ID. My query is: | chart max("duration") over task_id by "stage_id" | table task_id, stage_1, stage_2, stage_3, * In my results, tasks where stage 1 occurred are so long that they make all the other bars look really tiny. Is there a way that I could add to my query to filter out the task_ids where stage_1 occurred?

Posts	8
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎04-25-2022

Online Status	Offline
Date Last Visited	‎08-15-2022 08:43 PM

How to sample first N minutes of span in timechart...

How to Count multiple fields in histogram?

How can I aggregate information into rows based on...

Search, use the same results for two different sub...

Conditionally Omit Bin from Chart