Counting Sessions by Datacenter

Follow

Martin Fernandez

• July 07, 2017 17:23
• Edited

Hello All,

I am just trying to count user sessions by Datacenter using my nginx access.log. This session is showed as HKS in the URIs. This session can be located in different DCs at almost the same time. I was able to count all the distinct sessions using the following query

_source=nginx.access.log and _sourceName=/var/log/nginx/access.log  and "HKS"  | timeslice 5m
| count_distinct(HKS) group by _timeslice

What I want to do now, is to count by datacenter (_sourceCategory) but I faced the following issues when I attemped to do that

First Approach, using last operator. It works but I cannot use that in a LIVE dashboard

_source=nginx.access.log and _sourceName=/var/log/nginx/access.log  and "HKS"

| timeslice 5m

| parse field=_sourceCategory "*mfw" as DATACENTER

| last (DATACENTER) as data_center group by _timeslice, HKS

| count by _timeslice, data_center

| transpose row _timeslice column data_center

 

Second approach below, but it seems it counts the user session twice (remember a user session can be located in different Datacenters in the timeframe)

 

_source=nginx.access.log and _sourceName=/var/log/nginx/access.log and  "HKS"| timeslice 5m
| parse field=_sourceCategory "*mfw" as DATACENTER
| count_distinct(HKS) group by _timeslice, DATACENTER
| transpose row _timeslice column DATACENTER as *

Any ideas?

0

• 

  Olaf Stein

  • July 07, 2017 17:36

  Hi Martin,

  would the following work:

  _source=nginx.access.log and _sourceName=/var/log/nginx/access.log and "HKS"
  | timeslice 5m
  | parse field=_sourceCategory "*mfw" as DATA_CENTER
  | count by _timeslice, data_center
  | transpose row _timeslice column data_center

  or, if you want count_distinct:

  _source=nginx.access.log and _sourceName=/var/log/nginx/access.log and "HKS"
  | timeslice 5m
  | parse field=_sourceCategory "*mfw" as DATA_CENTER
  | count_distinct(HKS) by _timeslice, data_center
  | transpose row _timeslice column data_center

  Regards

  Olaf

   

  0

  Comment actions Permalink
• 

  Martin Fernandez

  • July 07, 2017 18:53

  Hi Olaf, 

  thanks for your reply. It seems that the last query is counting the HKS more than once. Remember that in a 5 minutes timeframe, the HKS can exists in different Datacenters. I just want to only count the HKS once (older or newer). 

   

  Any idea?

  0

  Comment actions Permalink
• 

  Olaf Stein

  • July 10, 2017 12:00

  You probably do not need the timeslice then. Will this work:

  _source=nginx.access.log and _sourceName=/var/log/nginx/access.log and "HKS"
  | parse field=_sourceCategory "*mfw" as DATA_CENTER
  | last(HKS) by data_center
  | count_distinct(_last) by data_center

  0

  Comment actions Permalink
• 

  Martin Fernandez

  • July 10, 2017 14:43

  Actually I need the timeslice to write a dashboard. Also I cannot use LAST in a Live dashboard :S 

   

  0

  Comment actions Permalink

Please sign in to leave a comment.