I have data for users running in two modes: Online, and Cached.
I want to get the average number of connections for each type of user over a 1 week period, so that I have a line graph and compare the load on the server for each type of user.
How can I do this? I think I'm way off track...
index=sanindex source="rpc" | timechart span=1h count(client_name)
client_mode is either Online or Cached. client_name is the name of a connecting user.
Thank you
James
Hi, James: Let me add more information about what you're looking for
The logs contains - client_mode: Classic, Cached, etc... - client_name: 100s of different values Each client_name is with either "client_mode=Classic" or "client_mode=Cached"
What to achieve
index=sanindex source="rpc" client_mode=Classic OR client_mode=cached earliest=-30d@d latest=@d | bucket _time span=1h | stats count by _time, client_name, client_mode | timechart avg(count) by client_mode
index=sanindex source="rpc" client_mode=Classic OR client_mode=cached earliest=-30d@d latest=@d | bucket _time span=1h | stats count by _time, client_name, client_mode | timechart avg(count) by client_mode
Thanks gkanpathy, but not quite.
I'd like to compare the average number of connections of each type, per day. So I take the average count of entries per day for client_mode=Cached, and the average count of entires per day where client_mode=Online, and then I can compare the two in a line graph.
Thank you for your help.
index=sanindex source="rpc" client_name=* | timechart span=1h count by client_mode