How to discard the last timeslice in a real time dashboard in a single value viewer
[Adding this post for Jitesh Motawani as we transition to a new platform]
I have a realtime dashboard monitoring the traffic flow across my application. I am using the single value viewer tile in a traffic light pattern. Since the last timeslice is the one that is still active and building up, its value can start from 10 and keep increasing count to reach ~1000. When the minute rolls over it starts again at a very low number as the minute progresses. What i want is to discard the live timeslice and report on the last completed timeslice a minute ago. (charting by 1m timeslices). does anyone know how can i achieve that? the reason why i want this is so that i know if the traffic is unexpectedly low on the platform at a given time.
what i currently see, but i dont want to see the last timeslice which is at a lull becoz data is still being ingested and indexed.
-
I was able to filter out the most recent timeslices from my realtime dashboards by adding a simple filter after the timeslice operator:
| where _timeslice < now() - 2m
I found this page trying to solve the same issue so I thought it was worth posting the solution I ended up with even though the question is very old.
Please sign in to leave a comment.
Comments
2 comments