每小时获取时间片，但按机器 ID 分组

Question

_sourceCategory=myService
| json field=_raw "log.Log" as log_message
| json field=_raw "log.Barcode" as log_Barcode
| json field=_raw "log.MachineId" as machine_id
| where log_message contains "successfully sorted"
| count by machine_id

此查询将为我提供每个机器 ID 的成功计数。

我想要的是获取过去 24 小时内的所有消息并获取每小时的平均成功率。

所以而不是拥有

Machine ID	Success Rate Count	TIME
123445	2400	24H

我得到了类似的东西

Machine ID	Success Rate Count per Hour	TIME
123445	100	24H

Answer 1

在使用if 语句应用时间片之前，您必须标记成功与失败。然后在字段上应用时间片和聚合并计算比率。比如：

_sourceCategory=myService
| json field=_raw "log.Log" as log_message
| json field=_raw "log.Barcode" as log_Barcode
| json field=_raw "log.MachineId" as machine_id
| if (log_message matches "*successfully sorted*", 1, 0) as success
| timeslice 1h
| count as total_records, sum(success) as successes by _timeslice
| successes / total_records * 100 as success_rate_pct