Skip to main content
Sumo Logic

Lab 5 - Joined Metrics Queries

  1. Last updated
  2. Save as PDF
This lab teaches you how to join different metrics series to create third series using math operators.

When working with Metrics in Sumo you can perform basic math operations  (+, -, *, /) on query results. Math expressions support the same set of functions as the eval operator so you can use sin, cos, abs, log, round, ceil, floor, tan, exp, sqrt, min, and max.

For example, if you are ingesting network information, you could use metrics queries and math operations to chart the net difference of incoming and outgoing network traffic. 

  1. Open a new Metrics window

  2. In the first row, define the incoming traffic as the result of rate and sum (to simplify the data). This will become our variable #A, please notice you do not need to declare #A as a variable, just Enter the following:

    metric=Net_InBytes | rate | sum

    By virtue of adding this query to the first line, we can refer back to it as #A. Any query on the second line can be referenced as #B and so on.

  3. In the second row, define the outgoing traffic as the result of rate and sum (to simplify the data). This will become our variable #B, please notice you do not need to declare #B as a variable. Enter:

    metric=Net_OutBytes | rate | sum

  4. In the third row subtract #A from #B. Enter:

    ​​​​​​​#B - #A

    step4.png

  5. Hide the A and B rows, so that your visualization only shows the difference.

    step5.png

    You now have a basic line chart of your rate of traffic over time.