Let's say I have a .csv content of the following structure,
PROCESS_5 (qa_cluster1server3),1,100,131,2012-10-01 15:50:00
PROCESS_6 (qa_cluster2server2),2,100,97,2012-10-01 15:50:00
....
I need to parse the cluster from which the data belongs out of the first comma delimited value,
source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?<server>PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server
which gets the following output,
_time qa_cluster1 qa_cluster2
01/10/2012 11:00:00.000 17785 34852
01/10/2012 11:05:00.000 17529 35039
....
But how can I get the ratio evolution between each different cluster?
(dividing the sum(EVOCATIONS) of one server by the other)
Use eval
something like this:
source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?<server>PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server
| eval ratio=qa_cluster1 / qa_cluster2
Use eval
something like this:
source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?<server>PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server
| eval ratio=qa_cluster1 / qa_cluster2
Thanks dwadlle.
It IS easy... I was overcomplicating it.
I just had to filter the fields to get the graph I intended.
source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?
| timechart span=2h sum(EVOCATIONS) by server
| eval ratio=qa_cluster1 / qa_cluster2
| fields _time, EvocationRatio