Hi All,
I have to monitor the queues. And for that I have made the basic dashboard where it shows the details. Details are like : queueName, inTotalMsgs, outTotalMsgs, pendingMsgCount and dedup the queueName.
Now, what I want is (another search [new]): "If the current pendingMsg count is greater than or equal to the last one hour count, then display the queueName with label - 'Queue with no processing since last one hour' "
(OR we can say the outTotalMsgs is same for now and last one hour event)
Example :
My basic new search no dedup applied, but currently I have written only one queueName :
..... | xmlkv | table _time, qName, pendingMsgCount, inTotalMsgs, outTotalMsgs
Timestamp (last 60 minutes) - (22/02/2019 06:58:00.000 to 22/02/2019 07:58:13.000)
Results : only one queueName (124 events)
first two :
last two :
So, for this queueName, the pendingMsg count is same and hence it should be displayed in results for dashboard - 'Queue with no processing since last one hour'.
I am not able to achieve this, please help!
Thanks in advance!
@vaibhavvijay9 ,
Try
| xmlkv | table _time, qName, pendingMsgCount, inTotalMsgs, outTotalMsgs|dedup _time,qName
|sort _time,qName
|streamstats last(pendingMsgCount) as prev current=f by qName
|eval diff=pendingMsgCount-prev| where diff>=0
This should give you Q names which haven't processed in last hour