Counting Sessions by Datacenter
Hello All,
I am just trying to count user sessions by Datacenter using my nginx access.log. This session is showed as HKS in the URIs. This session can be located in different DCs at almost the same time. I was able to count all the distinct sessions using the following query
_source=nginx.access.log and _sourceName=/var/log/nginx/access.log and "HKS" | timeslice 5m
| count_distinct(HKS) group by _timeslice
What I want to do now, is to count by datacenter (_sourceCategory) but I faced the following issues when I attemped to do that
First Approach, using last operator. It works but I cannot use that in a LIVE dashboard
| parse field=_sourceCategory "*mfw" as DATACENTER
| count_distinct(HKS) group by _timeslice, DATACENTER
| transpose row _timeslice column DATACENTER as *
Any ideas?
-
Hi Martin,
would the following work:
_source=nginx.access.log and _sourceName=/var/log/nginx/access.log and "HKS"
| timeslice 5m
| parse field=_sourceCategory "*mfw" as DATA_CENTER
| count by _timeslice, data_center
| transpose row _timeslice column data_centeror, if you want count_distinct:
_source=nginx.access.log and _sourceName=/var/log/nginx/access.log and "HKS"
| timeslice 5m
| parse field=_sourceCategory "*mfw" as DATA_CENTER
| count_distinct(HKS) by _timeslice, data_center
| transpose row _timeslice column data_centerRegards
Olaf
Please sign in to leave a comment.
Comments
4 comments