I have a user activity graph that has a line for each user logged into the system. I’m only interested in the ones that are doing a lot of requests though, i.e. that are very active.
I therefore want to put a threshold on the graph so it ONLY displays users/data points above say 20 opm. Otherwise my legend gets clogged up by hundreds of users doing 1-3 opm.
Is there a way to do this? The threshold feature just seems to draw lines on the graphs and be used for alerting, which is not what I want.
Which data source are you using? With Graphite you can use minimumAbove to show only series with a minimum above a given value, there is also averageAbove which is the same thing but uses the series average rather than the minimum.
In fact another solution may be to only show the lines with the highest values.
The root problem is that if I graph the last 15 mins of data it shows correctly, as it’s only trying to graph maybe 50 lines, but if I put it out to 3 hours there are then thousands of lines that it is trying to draw in theory. In practice is seems to give up after a set number, so the lines you’re actually interested in, the ones showing high values, are omitted completely from the graph.
Can you share the query you’re using? It would also be helpful if you could take the same screenshots but first click on the name of the series that shows high usage on the 1-hour graph so that only that one is shown for both time-scales.
The query is:
SELECT count(“amount”) FROM “AUTH” WHERE (“gateway” =~ /^$gateway$/ AND “provider” =~ /^$Provider$/) AND $timeFilter GROUP BY time(1m), “terminalNumber” fill(null)
The one that shows high on the 1 hour graph doesn’t show at all on the 3 hour graph, that’s the main problem! I think it’s because its just drawing the first 55 lines and then crapping out, and it hasn’t got to that value yet.
I effectively need it to show the top 55 by value, not the first 55 in whatever order it finds them.
SELECT count("amount") FROM "AUTH" WHERE ("terminalNumber" =~ (SELECT "terminalNumber" from (SELECT top("amount",20), "terminalNumber" FROM "AUTH" WHERE time >= now() - 1h))) AND $timeFilter GROUP BY time(1m), "terminalNumber" fill(null)
This complains because you can’t use a subquery like that.
SELECT amount, terminalNumber FROM (SELECT top("amount",20) as "amount" FROM "AUTH" WHERE $timeFilter GROUP BY "amount") WHERE $timeFilter GROUP BY "terminalNumber" fill(null)
This seems closer to me but still doesn’t seem to give me a clean graph. Single points are graphed for some terminalNumbers that do not show a line at all, so are not visible.
the < or > operator works but includes everything from the time frame you have selected and not using the last value received. so for example if you have a time range of 1 hour selected it will show if any wen > or < the threshold in that time range… how can you only base it of the last value?
