Logscape Support

Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: Search help minY axis?


Senior Member

Status: Offline
Posts: 100
Date:
Search help minY axis?
Permalink  
 


Hi Andy,

We dont directly support a floor or minY axis view on the chart - i.e. the recipricol of chartMax() - however you can achieve this type of filter by changing your search to filter the output from the count function

In the example below Im filtering the output of the count() function using lt() and gt(); notice how the functions TAG is used to associate the two (ideally we will support chaining).

GreaterThan.pngLessThan.png

 

HTH,

N.

www.logscape.com



-- Edited by neilson9 on Thursday 8th of November 2012 12:15:39 PM



-- Edited by neilson9 on Thursday 8th of November 2012 12:21:26 PM

Attachments
__________________
AndyH

Date:
Permalink  
 

Hiya guys,

I have the below search:

type='iis-log' | cIp.count() chart(line) csUriStem.contains(/webpage1.ashx)

What I want is to only show the IPs of customers which are hitting the specified URI X amount of times in the bucket or more, possibly being able to set the minY axis value? Is this possible or is there another way I could get this info do you think?

Thanks,

Andy.



__________________
AndyH

Date:
Permalink  
 

Yeah, I think that gets what we need. Learnt something new there too, thanks.

 

Andy.



__________________


Member

Status: Offline
Posts: 8
Date:
Permalink  
 

I didn't know you could apply a filter to the output of another function using the TAG - very handy - at least until you implement chaining!

__________________
AndyH

Date:
Permalink  
 

Hiya guys,

 

Its been a while.... I may have asked this before but if I did cant seem to find it or if it is possible.

 

Similar to this thread, we want to set up an alert that captures hits from one client in a web log if it is above say 100 in a specified bucket.

eg:

type='web-access-log' * | clientIp.count(,value) value.gt(100) bucketWidth(5m)

the resultant chart for this shows what we would expect and only those clientIps where there have been more than 100 entries in a 5 minute bucket, but when set up as an alert we just get everything from the log not just the IPs which met the criteria and it triggers all the time as well, not just if there is something to show on the chart or not.

Hope that makes sense and if so is this possible?

 

Cheers,

AndyH

 



__________________


Senior Member

Status: Offline
Posts: 100
Date:
Permalink  
 

Hi Andy,
We will take a look at this and come back to you... it certainly doesnt sound right!

Cheers Neil.

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.



Create your own FREE Forum
Report Abuse
Powered by ActiveBoard