Rounding Within a Timechart

Query

logscale
timeChart(function=max(value))
| round(_max, how=floor)

Introduction

Round a field and display using a Time chart.

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] 1[/Filter/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    timeChart(function=max(value))

    Creates a Time Chart using max() as the aggregate function for the value field.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] 1[/Filter/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | round(_max, how=floor)

    Rounds the implied field from the aggregate max() using the floor option to round down the value.

  4. Event Result set.

Summary and Results

Using the floor parameter to a function always rounds down a number. This is useful when displaying information in a time chart as all numbers resolved to their base value which can make the differences between values easier to distinguish when used on a graph.