How to develop a timechart by host with eval command?

[kualo]

Hi,

I have the below search to find the SLA of my application by host in the specific time span.
But I don't know why it won't show up SLA

some search | timechart span=30m count as VOLUME count(eval(respTime<=10)) as COUNT by host | eval SLA=COUNT/VOLUME*100

I want to show SLA and VOLUME together in the line graph so I tried below but it didn't work

some search | timechart span=30m count as VOLUME count(eval(respTime<=10)) as COUNT by host | eval SLA=COUNT/VOLUME*100 | fields + _time VOLUME SLA

Can someone help? Thanks!

[somesoni2 · Accepted solution]

The problem here is that when you use the timechart ( or chart command) with a by clause, the field name that you're going to see will be _time and VOLUME: host1, VOLUME: host2.... and COUNT: host1, COUNT: host2.... So when you're doing a SLA calculation, the field that you refer (plain COUNT and VOLUME) doesn't exist and hence it's not shown in the graph. In fact, if you check the legend of your line chart, you can see the name of the series will be similar to what I mentioned earlier.

If you want to show to total VOLUME and SLA for each host in a timechart, try like this.

some search | bucket span=30m _time | stats count as VOLUME count(eval(respTime<=10)) as COUNT by _time host | eval SLA=COUNT*100/VOLUME | timechart values(VOLUME) as VOLUME values(SLA) as SLA by host

Again, as mentioned earlier, you'd get fields like _time VOLUME:host1 VOLUME:host2... SLA:host1 SLA:host2...

[kualo]

Thanks! it works!

[badamastor]

This is exactly what I was looking for! Now, to what I believe is the easy part, I wanted to add a constant red line, indicating the SLA limit. I tried placing eval sla=99 , but it never shows.