Hi,
I’m working on a “state health” history panel for a dashboard but have the problem that my query returns too much rows (max limit = 5000 rows), so I want to optimize it.
So basically, I have a field “DSPHealthState” in my log lines that can have 3 values: “NORMAL”, “WARNING” & “CRITICAL”. I want to keep track of any state changes and display this in a state timeline component, so I can easily see at what time the states have changed.
I’m using LOKI datasource.
Right now, my query looks like this:
{job=“cotilogs”, host=“coti-test”} |= BaseNodeMonitorService |= DSPHealthState | pattern <Date> <Timestamp> <Level> <ProcessID> --- <Type> <Service> : Sources = <Sources>, DSPHealthState = <DSPHealthState> | line_format “{{.DSPHealthState}}”
This returns 5000 lines (which is the max I can get) with the state at every timestamp.
Is there a way to somehow change the query so I just get date ranges for the different states?
So instead of getting back results like this:
2022-09-09 13:12:00 NORMAL
2022-09-09 13:11:00 NORMAL
2022-09-09 13:10:00 NORMAL
2022-09-09 13:09:00 NORMAL
2022-09-09 13:08:00 WARNING
2022-09-09 13:07:00 NORMAL
2022-09-09 13:06:00 NORMAL
I want to get back the date ranges of the different states:
2022-09-09 13:09:00 - 13:12:00 NORMAL
2022-09-09 13:08:00 - 13:09:00 WARNING
2022-09-09 13:06:00 - 13:08:00 NORMAL
This would allow me to go back further in time on my dashboard, since I probably won’t hit that limit of 5000 rows this way.
Hope this makes sense, if something is unclear in my question, please let me know.
Thanks!