Line or Area chart of calculated field over time?

Comments

3 comments

  • Official comment
    Avatar
    Graham Watts

    Hey Felipe,

    You'll need to use the timeslice operator to create a trend over time, you might try something like the below query to take the average of the effectiveness value in 5 minute increments over time.

    Note that depending on how you want to measure this, you could also use operators like:

    • Max - max(effectiveness) as max_effectiveness by _timeslice
    • Min - min(effectiveness) as min_effectiveness by _timeslice
    • Pct - pct(effectiveness, 90, 95, 99) by _timeslice


    _sourceCategory=ods_payments 
    | if (status matches "3", 1, 0) as approved
    | if (status in ("0","1","2","4","5","6"), 1, 0) as notapproved
    | sum(approved) as approved, sum(notapproved) as notapproved
    | approved+notapproved as total
    | approved*100/total as effectiveness
    | fields effectiveness
    | timeslice 5m
    | avg(effectiveness) as avg_effectiveness by _timeslice

     

    Another popular option that I recommend exploring is the Outlier operator:

    _sourceCategory=ods_payments 
    | if (status matches "3", 1, 0) as approved
    | if (status in ("0","1","2","4","5","6"), 1, 0) as notapproved
    | sum(approved) as approved, sum(notapproved) as notapproved
    | approved+notapproved as total
    | approved*100/total as effectiveness
    | fields effectiveness
    | timeslice 5m
    | avg(effectiveness) as avg_effectiveness by _timeslice
    | outlier avg_effectiveness

     

    Hope this helps, let us know if you have additional questions here.

    Comment actions Permalink
  • Avatar
    Felipe Cerda

    Awesome, thank you Graham! A few minutes after posting this question I found your article on the ratios and percentages, which I ended up using. It's exactly what I was looking for.

    Thanks again!

    0
    Comment actions Permalink
  • Avatar
    Graham Watts

    Happy to help Felipe - if you use slack feel free to join our slack community at slack.sumologic.com, you can find me at: @grahamwatts-sumologic 

    0
    Comment actions Permalink

Please sign in to leave a comment.