Aggregating more than two fields into a graph

Comments

1 comment

  • Avatar
    Kevin Keech

    What is the memory value you want to show per time bucket? Average, min, max? The following example should show you the average memory per timeslice and stage and get you a chart with the multiple values. 

    (_sourceCategory=syslog namespace=*.fpm-access)
    | parse regex "(?<status_code>\d+?) memory_kb=(?<memory>\d+?) %cpu=(?<cpu>\d+\.\d+?)"
    | timeslice 400 buckets
    | avg(memory) as avg_memory by _timeslice, stage
    | transpose row _timeslice column stage

    If you want the max memory for each stage per timeslice you can simply change the "avg" operation to a "max" operation.

    (_sourceCategory=syslog namespace=*.fpm-access)
    | parse regex "(?<status_code>\d+?) memory_kb=(?<memory>\d+?) %cpu=(?<cpu>\d+\.\d+?)"
    | timeslice 400 buckets
    | max(memory) as max_memory by _timeslice, stage
    | transpose row _timeslice column stage

    I hope this might be what you were looking for. 

Please sign in to leave a comment.