Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

increase() function for unwrapped values #4200

Closed
loganmc10 opened this issue Aug 21, 2021 · 0 comments
Closed

increase() function for unwrapped values #4200

loganmc10 opened this issue Aug 21, 2021 · 0 comments

Comments

@loganmc10
Copy link

loganmc10 commented Aug 21, 2021

Is your feature request related to a problem? Please describe.
I'm using Loki to gather Netflow data. The unwrapped value is a "Bytes" counter, which is always increasing. I need to calculate "top talkers" and get the total data transferred. Right now I'm doing last_over_time()-first_over_time(), which works, but it's a little slow since there are thousands of unique label sets/conversations.

Also, last_over_time()-first_over_time() won't properly deal with breaks in monotonicity like increase() would/should.

Describe the solution you'd like
Prometheus has an increase() function for counters. It would be nice to be able to use that, I assume it would be faster than last_over_time-first_over_time, since it isn't doing 2 different queries?

Describe alternatives you've considered
last_over_time()-first_over_time()

Additional context
This is what I'm doing currently to get the top 20 conversations (this is done in Grafana so there are some dashboard variables in use):

topk(20,sum by (SrcAddr,DstAddr,SamplerAddress, DstPort, Proto) (last_over_time({job="netflow",SamplerAddress=~`${sampler:regex}`} | json | SrcAddr=~".*${src_addr}.*" DstAddr=~".*${dst_addr}.*" | unwrap Bytes[$__range]) - first_over_time({job="netflow",SamplerAddress=~`${sampler:regex}`} | json | SrcAddr=~".*${src_addr}.*" DstAddr=~".*${dst_addr}.*" | unwrap Bytes[$__range])))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant