Group by and count distinct

Graylog Central (peer support)
1

Hi, not sure if this is possible.

Let’s say I have 3 servers, and a field hostname populated with

Server01
Server02
Server03

Logs imported will have the following log_file_path field

\\Server01\Logs\Log1.txt
\\Server02\Logs\Log1.txt
\\Server03\Logs\Log1.txt
\\Server01\Logs\Log2.txt
\\Server02\Logs\Log2.txt
\\Server03\Logs\Log2.txt
\\Server03\Logs\Log2-1.txt
\\Server03\Logs\Log2-2.txt

What I would like to see is a stacked bar graph (or similar) where I can show
For each hour, show me the number of unique log files (count), stacked by hostname.

This would look something like this (created in Excel)

image

Is such a thing possible?

You’ll note that Server03 in my example generated more log files than the other servers (or at least, more log files were ingested) and that’s what I want to be able to visualise.

2

you would be able with the extended search - but not with the default widgets

3

Thanks - A bit of googling suggests to me that that is an enterprise feature only? (related to “views” ?)

4

yes - currently it is.

When it is deeper integrated into the system it will become part of the core and so open source.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.