Hi
I have X number of "totalHitCount" in a JSON file (mtr.gauges.caching_metrics.nodes{}.totalHitCount). Within multiple node{} and i am looking to graphs each node{}totalHitCount with time on Y and nodes{}.totalHitCount values - multiple series on the Y axis.
index=amber_live_* sourcetype=AMBER_METRIC usedMemoryMB | spath "mtr.gauges.caching_metrics.nodes{}.totalHitCount" | sort _time| table mtr.gauges.caching_metrics.nodes{}.totalHitCount _time
{ [-]
h: mx12405vm
mtr: { [-]
counters: { [+]
}
gauges: { [-]
caching_metrics: { [-]
clientCount: 5
locatorCount: 1
maxMemoryMB: 10240
memberCount: 4
nodes: [ [-]
{ [-]
bytesReceivedPerSecond: 0
bytesSentPerSecond: 0
cpuUsage: 0.21666667
gcCount: 96
gcTimeMilliseconds: 884
getsPerSecond: 0
locator: true
lruEvictionsPerSecond: 0
maxMemoryMB: 2048
nodeName: positions-gf-locator-v1-1
putsPerSecond: 0
readsPerSecond: 0
server: false
totalHitCount: 0
totalMissCount: 0
totalRegionCount: 0
totalRegionEntryCount: 0
usedMemoryMB: 205
writesPerSecond: 0
}
{ [-]
bytesReceivedPerSecond: 0
bytesSentPerSecond: 0
cpuUsage: 0.81666666
gcCount: 196
gcTimeMilliseconds: 1337
getsPerSecond: 0
locator: false
lruEvictionsPerSecond: 0
maxMemoryMB: 2048
nodeName: positions-gf-cacheserver-v1-1
putsPerSecond: 0
readsPerSecond: 0
server: true
totalHitCount: 1751992
totalMissCount: 114
totalRegionCount: 17
totalRegionEntryCount: 120
usedMemoryMB: 254
writesPerSecond: 0
}
etc...
Any help would be super thanks.
I did look at this
https://answers.splunk.com/answers/302236/how-to-take-multiple-key-value-pairs-and-draw-a-li.html
But the number of nodes could be dynamic, so not sure what to do.
Rob
hi
i got it
index=amber_live_* sourcetype=AMBER_METRIC usedMemoryMB
| spath "mtr.gauges.caching_metrics.nodes{}.totalRegionEntryCount"
| rename mtr.gauges.caching_metrics.nodes{}.totalRegionEntryCount AS totalRegionEntryCount
| rename mtr.gauges.caching_metrics.nodes{}.nodeName AS nodeName
| eval x=mvzip(nodeName,totalRegionEntryCount)
| mvexpand x
| eval x = split(x,",")
| eval totalRegionEntryCount=mvindex(x,0)
| eval nodeName=mvindex(x,1) | table _time totalRegionEntryCount nodeName | timechart bins=1000 max(nodeName) by totalRegionEntryCount
hi
i got it
index=amber_live_* sourcetype=AMBER_METRIC usedMemoryMB
| spath "mtr.gauges.caching_metrics.nodes{}.totalRegionEntryCount"
| rename mtr.gauges.caching_metrics.nodes{}.totalRegionEntryCount AS totalRegionEntryCount
| rename mtr.gauges.caching_metrics.nodes{}.nodeName AS nodeName
| eval x=mvzip(nodeName,totalRegionEntryCount)
| mvexpand x
| eval x = split(x,",")
| eval totalRegionEntryCount=mvindex(x,0)
| eval nodeName=mvindex(x,1) | table _time totalRegionEntryCount nodeName | timechart bins=1000 max(nodeName) by totalRegionEntryCount