Counting Sessions by Datacenter

Comments

4 comments

  • Avatar
    Olaf Stein

    Hi Martin,

    would the following work:

    _source=nginx.access.log and _sourceName=/var/log/nginx/access.log and "HKS"
    | timeslice 5m
    | parse field=_sourceCategory "*mfw" as DATA_CENTER
    | count by _timeslice, data_center
    | transpose row _timeslice column data_center

    or, if you want count_distinct:

    _source=nginx.access.log and _sourceName=/var/log/nginx/access.log and "HKS"
    | timeslice 5m
    | parse field=_sourceCategory "*mfw" as DATA_CENTER
    | count_distinct(HKS) by _timeslice, data_center
    | transpose row _timeslice column data_center

    Regards

    Olaf

     

  • Avatar
    Martin Fernandez

    Hi Olaf, 

    thanks for your reply. It seems that the last query is counting the HKS more than once. Remember that in a 5 minutes timeframe, the HKS can exists in different Datacenters. I just want to only count the HKS once (older or newer). 

     

    Any idea?

  • Avatar
    Olaf Stein

    You probably do not need the timeslice then. Will this work:

    _source=nginx.access.log and _sourceName=/var/log/nginx/access.log and "HKS"
    | parse field=_sourceCategory "*mfw" as DATA_CENTER
    | last(HKS) by data_center
    | count_distinct(_last) by data_center

  • Avatar
    Martin Fernandez

    Actually I need the timeslice to write a dashboard. Also I cannot use LAST in a Live dashboard :S 

     

Please sign in to leave a comment.