New Post-aggregate function 'eval()' - (eval(field/1000.0) for post-agg conversion i.e. convert bytes to Gigabytes or derive a unit-cost or something else! Use this in the post-agg way; note the use of '+'
Example 1: CPU: | CPU.avg(,POST) +POST.eval(CPU * 3.5)
Example 2: (multi-expr)
CPU: | CPU.avg(,POST) +POST.eval(CPU 3) +POST.eval(CPU 9,GB2)
Example 3:(with grouping):
CPU: | CPU.avg(_host,POST) +POST.eval(CPU * 100.22)
Example 4: Boolean flagging (shows 1 where value == true) (cool!)
CPU: | CPU.avg(_host,POST) +POST.eval(CPU < 30)
Example 5: Constant value:
* | _type.equals(agent-stats) eval(50,Mid) eval(50 * 2,Max))
New function 'percentile()' - allows you the plot a range of percentiles, either for a single-aggregate value (i.e. CPU across all machines or by region – where you see the percentiles values: 1,5, 25, 50, 75, 95, 99
Example: CPU.percentile()
Example: CPU.percentile( ,90) // determine 90th percentile
LogFile facet cache - store the facets of all fields on a data-type for a particular file where the field summary is true, or the field is a discovered key-value pair, improves performance by 40% on adhoc searches
summary.index() - Every search analytic that builds a search visualization processes the data according to its algorithm in order to create it (count, avg etc). The problem is that if you have searches that run over the same data again and again for long periods of time, i.e. 3 months, or 6 months, then these searches will be very slow due to the amount of processing/volume of data. The introduction of a ‘summary.index()’ allows for pre-build search results at a particular granularity (10 minute default). When searching against the summary.index the results are retrieved, re-bucketed to fit the search and passed back to the visualisation.
Read how to use summary.index() on our Blog Post.
New home workspace A freshly designed homepage display many new and improved features of Logscape 3.10
NOTE - For existing installations you will need to manually deploy the new homepage by re-deploying the logscape-home.config which can be found on the deployment page.
Workspace Code Editor - Both the Single Value Panel and HTML Widget have recieved a feature rich editor to replace their plain text boxes.
Optional (client-server side) control of workspace-filtering in Workspace-Charts. Until now each chart would choose whether or not an event was filterable in the legend (client-side). This choice was based upon the legend, charts like pie and maps would always re-run the search. However people was to allow the search to re-run, expecially when it cannot be filtered at the legend. i.e. CPU.percentile() will show cpu across all hosts, however the legend shows percentile values; now you can re-run the search by enabling the flag on the edit panel.