Line chart of unaligned data
I am having trouble charting some data. The thing that makes it difficult appears to be that the data is reported sporadically. That is the log messages are infrequent and not synchronized between sources. I can chart any individual source like this:
MESSAGE_ID=4fb314fb404e4952b3db4b5baac64fdc
| json field=_raw "PATH", "TYPE", "BYTES_USED", "BYTES_TOTAL"
| where _hostname == "t6" && path == "/"
| _messagetime as _timeslice
| bytes_used/bytes_total as fullness
| max(fullness) as fullness by _timeslice, path, type
| transpose row _timeslice column path, type
Updating the `where` clause will allow me to select and correctly chart any individual disk. However if I try to make a graph with multiple series, such as all disks on a host or all disk on all hosts the chart treats the `null` for the hosts that haven't reported a value as `0` and the graph is very messy.
MESSAGE_ID=4fb314fb404e4952b3db4b5baac64fdc
| json field=_raw "PATH", "TYPE", "BYTES_USED", "BYTES_TOTAL"
| where _hostname == "t6"
| _messagetime as _timeslice
| bytes_used/bytes_total as fullness
| max(fullness) as fullness by _timeslice, path, type
| transpose row _timeslice column path, typ
I have tried using `timeslice` but it doesn't work as it will graph any slice that doesn't have a message for the relevant disk as 0 still. Is there any way to keep sumologic from treating missing values as 0?
Please sign in to leave a comment.
Comments
0 comments