Display Highest Average Trends over time

Comments

4 comments

  • Official comment
    Avatar
    Harsh Jain

    It is easily feasible with the latest addition of new filter operator which internally fires another query.

    We can leverage filter operator for finding the top 5 containers with the highest average CPU usage and categorize only top 5 prompted containers.

    Potential Query:

    searchExpression |  parse "cpuUsage=*," as cpuUsage

    | timeslice 5m | avg(cpuUsage) as avgCpuUsage by container,_timeslice

    | filter container in ( avg(avgCpuUsage) as avgCpu by container | top 5 container by avgCpu)

    | transpose row _timeslice column container

    Comment actions Permalink
  • Avatar
    Mario Sanchez

    Hey Garrett,

    Would this example help you with what you're trying to achieve?

    https://support.sumologic.com/hc/en-us/community/posts/115007966748-Top-10-IP-Addresses-by-Timeslice

    Cheers,

    Mario

     

    0
    Comment actions Permalink
  • Avatar
    Garrett Hartnell

    That's not quite what I am looking for, because it counts by timeslice. What I would like to do is find the average over all the time slices, then display the containers with the top 5 averages over all time slices.

    0
    Comment actions Permalink
  • Avatar
    Garrett Hartnell

    That works perfectly, thanks!

    0
    Comment actions Permalink

Please sign in to leave a comment.