Stacked column chart for average values of arbitrary keysAverage timeslice



  • Avatar
    Jorge Silva

    Give this query a try:

    _sourceCategory="<source>" AND "<filter>"
    | json field=_raw "my_field" as my_field
    | parse regex field=my_field "(?<key>[^\"]+?)\"\s*:(?<value>\d+\.\d+)" multi
    | fields -_raw
    | timeslice 2m
    | avg(value) by _timeslice, key
    | transpose row _timeslice column key

    Here we use parse regex to extract each key and its value, then we average the value by timeslice and key and finally we use the "transpose" operator to create your chart.

    Comment actions Permalink
  • Avatar
    Daniel Olshansky

    That works perfectly Jorge, thanks so much!

    Just for anyone else who might stumble upon this post, the above query can be used to easily created a stacked column chart where different log lines have an arbitrary number of key-value pairs and the keys are not known ahead of time, like so:


    log1: {"key1": 1} 
    log2: {"key1": 2, "key2": 3} 
    log3: {"key1": 4, "key2": 5, "key3": 6}


    key1: avg(1, 2, 4) 
    key2: avg(3, 5) 
    key3: avg(6)
    Comment actions Permalink

Please sign in to leave a comment.