Is there a method of tracking a service ceiling over the long term? I have daily transaction that are being summarized over suitable interval and written to a summary index. I wish to keep a maximum of the transaction fields (count, success, by category, etc) for hourly, daily intervals, and have the maximum of the maximum or peak(maximum) for each of those transaction fields representing the service ceiling or maximum observed values for those fields. The maximum observed value will be later used to calculate a utilization of the service. I am kind of thinking that the answer is probably a daily report that consumes the summary index, calculates the daily maximum observed values, then write the daily maximums to a summary_index stash. I am having trouble approaching the problem and am looking for ideas and/or guidance. Currently I am playing with streamstats and a window.
| search ...
| bin span=600s _time
| streamstats window=1 current=f sum(successful) AS previous_successful_transactions
| streamstats sum(successful) as successful_transactions
| fillnull value=0 previous_successful_transactions successful_transactions, peak_transactions
| eval peak_transactions=if(successful_transactions>previous_successful_transactions, successful_transactions, peak_transactions)
| chart max(previous_successful_transactions) as previous_successful_transactions max(peak_transactions) as peak_transactions by _time
... View more