transpose to show percentage column and not count

Comments

1 comment

  • Avatar
    Kevin Keech

    A few other aggregation operators that you may be able to use are min, max, and avg. So maybe something like the following will help get you the result you need?

    | parse "source=* " as app
    | parse "memory_quota=*MB" as total_memory
    | parse "memory_rss=*MB" as used_rss_memory
    | parse "memory_total=*MB" as used_total_memory
    | parse "memory_cache=*MB" as cached_memory
    | (used_total_memory/total_memory)*100 as memory_used 
    | timeslice 5m
    | max(memory_used) as memory_used by app, _timeslice
    | transpose row _timeslice column app

    This should result in a time series chart with a line for each app percentage, based on the max percentage for each app within each 5 minute slice.

Please sign in to leave a comment.