Metrics - Classic

Structure of metrics queries

To create a metrics visualization on the Metrics page, you can specify up to six metrics queries. Enter each query in a separate query text box. Query text boxes are added as needed, up to the maximum of six.

• Each metrics query must include one or more selectors (filters), which can be either of the following:
  • Sequence of space-separated tag=value pairs:
    cluster=search node=search-1
  • Unqualified strings (value with no key):
    statistic
• Each query can optionally include one or more operators (avg, count, min, max, sum, and so on):
  dep=prod metric=cpu_system | avg
• Grouping of results by operator is supported, as in this example, which groups average results by node:
  dep=prod metric=cpu_system | avg by node
• Logical operators are supported, as in this example which uses NOT, OR, and AND:
  not node=forge-12 and cluster=forge and (CPU_Idle or Idle_CPU) | avg

Color-coding of metrics query components

Metrics queries are color-coded to help you identify key elements.

Multiple selectors in a query

If you specify multiple selectors in one query, results are returned if all values match. For example, 
the following query returns time series that match deploy=prod AND have the word search appearing anywhere in the metadata:
deploy=prod search

Multiple queries

If you specify multiple queries, each is displayed as a separate set of time series charts. In the following example, the time series that match query A are shown with solid lines and the time series that matches query B is shown as a dotted line. See Create and Tailor Line and Area Metric Charts to learn about displaying particular time series and changing line styles.

How to construct a metrics query

On the Metrics page, click inside the query text box. When you first click inside the box, a help bubble opens to show the general query syntax:

SELECTORS [| OPERATOR | ...]

If you use logical operators in your query, follow this order of precedence, starting with most associative:

1. = (dimension selector)
2. NOT/! (either operator will work)
3. AND (default operator, you don’t have to specify this one but you can)
4. OR

The help bubble also includes examples:

_sourceCategory=category* metric=CPU_User | avg by _sourceHost
prod.*.*.disk.space | max by node

To dismiss the bubble and display suggestions, press the spacebar. To dismiss the bubble without displaying suggestions, press esc.

Follow these guidelines to complete your queries:

• Specify multiple pairs within a query for an AND, OR, or NOT/! match. If you enter multiple pairs manually, make sure to include a space between the tag=value pairs. For example, this query matches HostMetrics AND the instance identifier i-e0b45532:
  _contentType=HostMetrics InstanceId=i-e0b455532
• Create up to six queries using multiple query text boxes. Each query is presented with its own graph or graphs in the chart area. See Interacting with Metric Charts for information on viewing and managing the display of multiple queries.
  
  When you add a query, an additional query text box is added (up to six total). To delete any of the query text boxes, hover over the text box and click the Delete icon on the right.

• You can use wildcard matches for selectors and/or values, as in these examples:
  sys*  and *tem both match system.
  foo* matches all of the following:
  footag-a=
foo1tag-b=
tag-c=foo2

• You can include aggregation functions and other operators, as in this example: 
  _sourceHost=sys1-cloudcollector-* metric=CPU_Idle | avg

Joined metrics queries

You can perform basic math operations  (+, -, *, /) on two or more metrics queries. And in the expression of these values in a third row, you can associate and correlate information as needed in a single, joined visualization.

Save a metric query

When you save a metric query, it will be saved the currently selected time range, chart options, outlier detection, and quantization settings to the Sumo Logic library. Timezone is saved using UTC format, as is the case for other search content in the library, so you can share content with users in different  time zones without problem.

Follow these steps to save a metric query.

1. Enter a metric query, and run it to make sure it returns results.
2. Click the save icon in the upper right corner of the metric query tab.
3. The Save Item popup appears.
   
4. Name. Enter a name for the metric query
5. Navigate to the folder where you want to save the query.
6. Click Save.

Metric query errors

Sumo Logic will present an error message when a metric query times out or returns too many matching time series.