Hello,
I have a file that looks like the following:
date1 node1 seq_13 seq13_total_time
date1 node1 seq_12 seq12_total_time
date1 node1 seq_11 seq11_total_time
date1 node1 seq_10 seq10_total_time
date2 node2 seq_13 seq13_total_time
date2 node2 seq_12 seq12_total_time
date2 node2 seq_11 seq11_total_time
date2 node2 seq_11 seq11_total_time
date3 node3 seq_13 seq13_total_time etc...
The fields are named date, node, seq_num, and seq_total_time. The date changes with the new reporting node. Seq_total_time represents a transaction time in seconds.
I'm trying to create a mutiseries timechart where on the Y axis is seconds. For the data points I need to avg all of the seq_total_times reported by each individual node for a given seq_num and time. I would have multiple data points for each time slot (1 hour) representing the avg for each seq_num.
I think I need to use a transaction for this - but I'm not sure of how to format the search. Can anyone help to provide a few ideas?
Thank you
You don't need to (and therefore should not) use transaction
. Perhaps your solution is as simple as:
source=my_data | timechart avg(seq_total_time) by seq_num
But another interpretation is:
source=my_data | eval nseq=node."--".seq_num | timechart avg(seq_total_time) by nseq