Now I mod the crontab's shell,it run every 10minutes, only ip changed,it write into influxdb,database looks like:
Can I caculate the none NULL data's ELAPSED time ?
> select * from "exec_wanip"
name: exec_wanip
time host value
---- ---- -----
1542951090000000000 monitor
1542951140000000000 monitor
1542951150000000000 monitor 118.114.187.199
1542951160000000000 monitor
1542951170000000000 monitor
1542951180000000000 monitor
1542951190000000000 monitor
1542951200000000000 monitor
1542951210000000000 monitor
1542951810000000000 monitor
1542952410000000000 monitor
1542953010000000000 monitor
I record WAN ip via crontab,here is the data in influxdb,and ip address is variable.
how could I caculate the life time of each ip address ?
> select * from exec_wanip
name: exec_wanip
time host value
---- ---- -----
1542856250000000000 monitor 118.114.187.208
1542856850000000000 monitor 118.114.187.208
1542857450000000000 monitor 118.114.187.208
1542858050000000000 monitor 118.114.187.208
1542858650000000000 monitor 118.114.187.208
1542859250000000000 monitor 118.114.187.208
1542859850000000000 monitor 118.114.187.208
1542860450000000000 monitor 118.114.187.208
1542861050000000000 monitor 118.114.187.208
1542861650000000000 monitor 118.114.187.208
1542862250000000000 monitor 118.114.187.208
1542862850000000000 monitor 118.114.187.208
1542863450000000000 monitor 118.114.187.208
1542864050000000000 monitor 118.114.187.208
1542864650000000000 monitor 118.114.187.208
1542865250000000000 monitor 118.114.187.208
Your modified script is still not setting ip as tag.
And my guess is that you actually store empty strings as value - not NULLs.
The query for this data:
SELECT 600*count(value) AS Lifetime_seconds FROM exec_wanip WHERE value<>''
Using filtering on values in WHERE clause is not good for InfluxDB performance in general. I would recommend to change the cron script to put data with line protocol lines like these into your db:
exec_wanip,host=monitor,ip=118.114.187.208 value=118.114.187.208
exec_wanip,host=monitor,ip=118.114.187.199 value=118.114.187.199
...
using curl POST or cli INSERT equivalent.
curl -XPOST "http://localhost:8086/write?db=mydb" --data-binary 'exec_wanip,host=monitor,ip=118.114.187.208 value=118.114.187.208'
curl -XPOST "http://localhost:8086/write?db=mydb" --data-binary 'exec_wanip,host=monitor,ip=118.114.187.199 value=118.114.187.199'
After this is done you'll be able to calculate ip life time with query like this:
SELECT 600*count(value) AS Lifetime_seconds FROM exec_wanip GROUP BY ip
Add WHERE clause to query with time range selection as needed.
Note: anything can be used as value here, not necessarily ip address, for example 'up'/'down', etc.
Related
I created a continuous query to downsample readings from temperature sensors in my influxdb to store hourly means for a longer time. There are readings of multiple sensors in one table. Upon executing the query, the sensors ip is missing.
Basic data looks like this:
> SELECT ip,tC FROM ht LIMIT 5
name: ht
time ip tC
---- -- --
1671057540000000000 192.168.0.83 21
1671057570000000000 192.168.0.83 21
1671057750000000000 192.168.0.17 21.38
The continuous query (simplified without CREATE ... END):
SELECT last(ip), mean("tC") AS "mean_temp" INTO "downsampled"."ht_downsampled" FROM "ht" GROUP BY time(1h),ip
The issue is, the value of 'ip' is only a tag, not the value in the table and subsequently is missing in the table the query inserts into:
name: ht
tags: ip=192.168.0.17
time ip mean_temp mean_hum
---- -- --------- --------
1671055200000000000 21.47 42.75
1671058800000000000 21.39428571428571 48.785714285714285
1671062400000000000 21.314999999999998 51.625
Why is last(ip) not producing any value?
Can I get the value from the 'tags' into the table?
Is there a different approach to group data with a constant value?
Could you just try query the ip instead of the last(ip) since you are grouping by the ip in the statement already?
Sample code:
SELECT ip, mean("tC") AS "mean_temp" INTO "downsampled"."ht_downsampled" FROM "ht" GROUP BY time(1h), ip
I've been setting up Grafana to pull some annotations from an InfluxDB database.
It seems that when multiple annotations exist within the same millisecond, Grafana will only display the last one.
Is there a way to display multiple annotations that occurred within the same millisecond ? This is for a high-time precison project so I prefer to avoid hacking it by modifying event timestamps.
Here's an example InfluxDB database:
> select * from events;
name: events
time key name title
---- --- ---- -----
1515664469946000001 as_start event1 test
1515664469946999999 as_start event4 test
1515664469947000000 as_start event3 test
1515664469956000000 as_start event2 test
I use the following query in Grafana:
select "name","title","key" from events WHERE $timeFilter
Which yields this:
graph screenshot
"event1" is not visible and was instead "overwritten" by "event4". "event3" and "event2" are visible however.
Thanks!
select SUM(value)
from /measurment1|measurment2/
where time > now() - 60m and host = 'hostname' limit 2;
Name: measurment1
time sum
---- ---
1505749307008583382 4680247
name: measurment2
time sum
---- ---
1505749307008583382 3004489
But is it possible to get value of SUM(measurment1+measurment2) , so that I see only o/p .
Not possible in influx query language. It does not support functions across measurements.
If this is something you require, you may be interested in layering another API on top of influx that do this, like Graphite via Influxgraph.
For the above, something like this.
/etc/graphite-api.yaml:
finders:
- influxgraph.InfluxDBFinder
influxdb:
db: <your database>
templates:
# Produces metric paths like 'measurement1.hostname.value'
- measurement.host.field*
Start the graphite-api/influxgraph webapp.
A query /render?from=-60min&target=sum(*.hostname.value) then produces the sum of value on tag host='hostname' for all measurements.
{measurement1,measurement2}.hostname.value can be used instead to limit it to specific measurements.
NB - Performance wise (of influx), best to have multiple values in the same measurement rather than same value field name in multiple measurements.
I have 3000 Sensors 1500 of temperature 1000 of humidity and 500 of pressure
Each of these sensors are mapped to a location , i.e I have 3000 locations
Location can be like Building/Block/Floor/Room/LocA and Building/Block/Floor/Room/LocB (this being the parent Building/Block/Floor/Room )
data is read from the sensors every 15 seconds
What should be my schema for InfluxDB ?
Here are my thoughts
I thought I will have these as measurements
temperature
pressure
humidity
And the Tags as Location | sensorID (3000 tags for all the sensors which makes my cardinality 3000 )
Location | sensorID
---------|---------
location A| sensor1
location B| sensor2
so I will have 3000 series, data stored every 15 seconds Is this scalable?
Do you see any issues with this schema design
Seems fine if the system is more than 8GB RAM in large scale.Please refere the following doc from influxdb https://docs.influxdata.com/influxdb/v1.7/guides/hardware_sizing/
Is there a simple test to make sure I have proper influxdb communication?
My configuration looks like this
influxHost = influxhost:8086
smtpHost = mail:25
emailFrom = user#domain.com
template cpu {
body = `Alert definition:
Name: {{.Alert.Name}}
Crit: {{.Alert.Crit}}
Tags:{{range $k, $v := .Tags}}
{{$k}}: {{$v}}{{end}}
`
subject = cpu idle at {{.Alert.Vars.q | .E}} on {{.Tags.host}}
}
notification default {
email = user#domain.com
next = default
timeout = 1h
}
On the bosun expression evulator I am doing
influx("db",'''SELECT mean(usage_idle) FROM "cpu" group by host''',"10m","","2m")
I keep getting
influx: did not get a valid result from InfluxDB
Make sure you have the correct influx database and that there is data in the specified time range. I usually try from the admin site first:
Then insert the query into the influx(...) expression
Bosun will add the time conditions to the WHERE and GROUP BY clauses as needed, so the full influxql generated should be something like:
SELECT mean(usage_idle) FROM cpu WHERE time >= '2016-12-07 20:00:00' AND time <= '2016-12-07 20:10:00' GROUP BY host,time(2m)
If it still doesn't work try SELECT * FROM cpu on the admin page to see what data is in the table (telegraf has gone thru a few changes). Also note in the recent versions you probably want to add cpu = 'cpu-total' to the WHERE clause to get the overall average.