Hello,
I have 5 Servers. Every server has an actual count of user sessions. I want them to sum up, without loosing the trend funcion in the single value chart.
This is my actual query:
index=ascrm sourcetype=jmx NumUiSessions=* host IN (z1il0095*,z1il0096*,z1il0097*,z1il0098*)
| stats latest(NumUiSessions) as latest_NumUiSessions by host
| stats sum(latest_NumUiSessions) AS UISessions
Could anyone give me a clou?
Best regards
Benjamin
I want to trend against the value x hours ago. I have a time picker with token. This time token shoul be used to define x.
Something like this?
index=ascrm sourcetype=jmx NumUiSessions=* host IN (z1il0095*,z1il0096*,z1il0097*,z1il0098*)
| bin _time span=1h
| stats latest(NumUiSessions) as latest_NumUiSessions by host _time
| streamstats sum(latest_NumUiSessions) AS UISessions by _time
What are you trending against, because you currently only have one value remaining?