Hello, I’m a beginner with Grafana Loki and need some help.
I want to create a time series and a pie chart that count the number of log_point labels within a 12-hour range.
Here’s the query I’m using:
sum by (log_point) (
count_over_time({job="alog"} [time])
)
When I try the following settings:
-
Time: $__auto → Panel options > Calculation: Total
-
Time: 12h → Panel options > Calculation: Last*
…the results are not the same.
But I expected them to be the same.
My understanding is that when I set the range to 12 hours and use Calculation: Total, Grafana should aggregate the values by splitting the 12h into smaller intervals and summing them up — which should match the result of case 2.
My questions are:
-
Why are the results from case 1 and case 2 different?
-
If I want to get the number of log_point values within a specific time period using both time series and pie chart, what is the correct approach?
-
Do I also need to adjust the query option (range / instant) for this?
Thank you for your support and patience 
When you use graph that aren’t time series generally speaking option 2 is more efficient. That said, I think your problem might be from your query settings. When you go with option 2, you want to make sure your query is configured to be an `instant` query, and under query options you want to make sure to only return with 1 data point.
You can also print out your query data points to a table and compare.
As shown in the attached image, when I set the query option to “range”, I get the counts by log_point. But when I set it to “instant”, I get different values.
I don’t understand why this happens.
What’s your pie chart’s value configured? Last or sum of all data points?
It’s important to remember that when using a range query you can potentially get a more data than if you were using an instant query. For example, let’s say you are sending a range query with 3h interval, for the past 12 hours, the very first data point, which is at the time of now-12h, has an interval of 3h as well, so it would actually contain data from now-15h to now-12h, whereas if it’s an instant query with 12h interval then it’s just now-12h.
This is why when I am using a graph that’s not time series I usually use instant query with 1 data point.
1 Like
