I've been trying to customize the tooltips that appear when you hover over charts on the dashboard.
For reference consider a query that ends with some aggregating that looks like this:
| timeslice 1h
| sum(success) as success, sum(redirect) as redirect, sum(client_error) as client_error, sum(server_error) as server_error by _timeslice
| success + client_error + server_error + redirect as total
| ((client_error + server_error)/total)*100 as %"Error %"
| fields %"Error %"
This is some basic HTTP traffic monitoring, I want to graph the % error, that is most important! However I want to see more when I roll over the chart. Can the tooltip help me?
The first problem I had was that, when I hovered over the graph, I couldn't see the time for each data point. This was pretty easily fixed by changing the last line to look like so:
| fields %"Error %", _timeslice
This makes things better, I can see the timeslice! But i still have problems that I can't solve, I've searched and found nothing....
Q1: How can I make the timestamp more concise?
Currently my timestamp when I hover is "02/10/20 11:00:00 AM -0800". I have one hour buckets, I know my timezone, the year rarely changes... how can I make the timestamp simply "02/10 11 AM"
Q2: How can I show other data when I hover
When we see a large number of errors, we also want to know how many total successes there were (a 50% error rate is not a problem if there were only 2 requests).
My naive try to fix this was to add the success to the fields like so:
| fields %"Error %", _timeslice, success
This was a miserable failure, now I get a whole additional graph of the 'success' data points, which I guess I could have expected because well this is the supported way to graph additional fields. And of course my tooltip on "Error %" doesn't change.
How can I make some additional information like this only appear on the tooltip? I'm wanting some kind of fancy formatting language, like a printf, where I can customize to my heart's content. Is that available?
Please sign in to leave a comment.