I have a bunch of hosts streaming logs that show metrics like cpu count. The problem is that they all send those logs at different times. I'm trying to calculate perform math on the aggregate metrics, but everything is wrong because I can't figure out how to perform math on the values from distinct hosts. I've searched for deduping on a span and got nowhere. Logs look something like this:
1:00:01 - ip=192.168.1.5 cpu_count=8
1:00:01 - ip=192.168.1.6 cpu_count=8
1:00:02 - ip=192.168.1.7 cpu_count=8
1:00:03 - ip=192.168.1.8 cpu_count=8
1:00:03 - ip=192.168.1.7 cpu_count=8
1:00:03 - ip=192.168.1.5 cpu_count=8
1:00:03 - ip=192.168.1.6 cpu_count=8
1:00:04 - ip=192.168.1.7 cpu_count=8
1:00:04 - ip=192.168.1.8 cpu_count=8
what i want to do is something like | dedup span=1m by ip | eval TotalPercent = cpu_count * 100 | timechart sum(TotalPercent) AS TotalAvailableCPUPercent
hope that makes sense
You probably want bucket
for grouping your events by time and deduping on that.
... | bucket _time span=1m | dedup _time ip | eval TotalPercent = cpu_count * 100 | chart sum(TotalPercent) AS TotalAvailableCPUPercent over _time
You probably want bucket
for grouping your events by time and deduping on that.
... | bucket _time span=1m | dedup _time ip | eval TotalPercent = cpu_count * 100 | chart sum(TotalPercent) AS TotalAvailableCPUPercent over _time