grafanagrafana-lokilogqlgrafana-dashboard

Facing an issue with time ranges in queries


Can someone help me understand how to query for different specific time ranges in Grafana? I'm using count_over_time, and I want to subtract the count of systems that sent the lines "Timestamp" in the last hour from the count of systems that sent the line "Timestamp" in the last minute. Both outcomes seem to depend solely on the dashboard time ranges, not on the values I input. Am I using the functions incorrectly?

My end goal is to visualize this number in a pie chart. So, if transformations might help here, that would also be a viable solution.

Timestamps sent in the last hour Supposed to be timestamp sent in the last minute Adds up to 0 even if it should be 1


Solution

  • sum(count by(label) (something)) is equivalent to count(something); based on the description this is not what you want. If you want to get number of distinct systems you need count(count by(system) ( ..your_selector.. )).

    After that, you graph visualizes exactly what you asked it to (but probably you forgot to account for cases when logs are missing. To do that, you can use this

    ( count(count by(system) ( count_over_time(..your_selector.. [1m]) ) or vector(0) ) 
    - ( count(count by(system) ( count_over_time(..your_selector.. [1h]) ) or vector(0) )
    

    A couple notices: