I have similar json input as below, every minute similar blocks of data is send to index.
I am plotting timechart but its constraint is we can provide only one field after "by" as below:
index="test19" | eval res = readio / 1 | timechart span=60 avg(res) as AVG usenull=f by sid
but i need value of readio to be averaged for a unique combination of (did and lun) or (sid,lun) or (sid,did)
if suppose i take a combination of s1,d1 there are 5 rows for which avg to be calculated
similarly for s2,d1 has 4 rows
so the timechart should be showing avg of "readio" for s1-d1(avg of 5 values),s2-d1(avg of 4 values),s3-d1(avg for 4 values),s1-d2(avg of 2 values),s1-d3(avg of 3 values) as series
--event 1 - all records going at once
{"sid": "s1", "did": "d1","lun": "l1","readio":"10","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l2","readio":"50","iocompletetime":"10","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l3","readio":"5","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l4","readio":"100","iocompletetime":"20","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l5","readio":"1","iocompletetime":"1","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l6","readio":"5","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l1","readio":"15","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l2","readio":"10","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l3","readio":"10","iocompletetime":"1","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l4","readio":"12","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s3", "did": "d1","lun": "l6","readio":"19","iocompletetime":"3","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s3", "did": "d1","lun": "l7","readio":"105","iocompletetime":"25","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s3", "did": "d1","lun": "l8","readio":"66","iocompletetime":"15","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s3", "did": "d1","lun": "l9","readio":"80","iocompletetime":"20","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d2","lun": "l1","readio":"200","iocompletetime":"40","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d2","lun": "l2","readio":"20","iocompletetime":"5","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d3","lun": "l3","readio":"25","iocompletetime":"5","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d3","lun": "l4","readio":"50","iocompletetime":"8","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d3","lun": "l5","readio":"70","iocompletetime":"6","Timestamp": "2018-03-24 06:12:53"}
--event 2 all records going at once
{"sid": "s1", "did": "d1","lun": "l1","readio":"10","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l2","readio":"50","iocompletetime":"5","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l3","readio":"5","iocompletetime":"1","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l4","readio":"100","iocompletetime":"30","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l5","readio":"1","iocompletetime":"1","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l6","readio":"5","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l1","readio":"15","iocompletetime":"4","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l2","readio":"10","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l3","readio":"10","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l4","readio":"12","iocompletetime":"3","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s3", "did": "d1","lun": "l6","readio":"19","iocompletetime":"5","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s3", "did": "d1","lun": "l7","readio":"105","iocompletetime":"20","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s3", "did": "d1","lun": "l8","readio":"66","iocompletetime":"5","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s3", "did": "d1","lun": "l9","readio":"80","iocompletetime":"6","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d2","lun": "l1","readio":"200","iocompletetime":"40","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d2","lun": "l2","readio":"20","iocompletetime":"5","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d3","lun": "l3","readio":"25","iocompletetime":"3","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d3","lun": "l4","readio":"50","iocompletetime":"6","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d3","lun": "l5","readio":"70","iocompletetime":"8","Timestamp": "2018-03-24 06:13:23"}
... View more