index=X sourcetype=X source=X | timechart first(percentage_allocation) as percentage_allocation by devicename
I am facing an issue with the following query, in case, where there are multiple logs with a different variable named "link" and I would like to use that as a data search like :
devicename=a percentage_allocation=1 link=a
devicename=a percentage_allocation=2 link=a
devicename=a percentage_allocation=3 link=b
Above query will look for the first log of percentage_allocation by devicename in that month and show percentage allocation, but i would like to make sure it shows me on a basis of different links as well, but I can't see any option to use any function to get data on a basis of new variable which is "link" in timechart as it allows only BY keyword and OVER is already for time.
Can i use a 3rd variable as a data qualifier?
you could use an eval to combine your devicename and link into one field then do a timechart
index=X sourcetype=X source=X
| eval device_link = devicename." - ".link
| timechart first(percentage_allocation) as percentage_allocation by device_link
you could use an eval to combine your devicename and link into one field then do a timechart
index=X sourcetype=X source=X
| eval device_link = devicename." - ".link
| timechart first(percentage_allocation) as percentage_allocation by device_link
This works like charm . I didnt knew i can use timechart command like that too . Thanks for help .
can not·
Can you substitute BIN and STATS for example?
index=X sourcetype=X source=X
| bin span=XX _time
| stats first(percentage_allocation) as percentage_allocation by _time,devicename,link
This stats query doesnt work as i am expecting output in chart .