Extracting pointTagKey and associated value

[bradleyka93]

Hi,

I have a ts() expression which will result in a metric and want to extract a particular pointTagKey from that metric called "host", then want to pass this value to another ts() expression so that it uses the host to determine the metric. I tried metadata function aliasSource but it did not work.

Example"

My first ts is like this: ts("metricname", tag1=valu1 and tag2=value2)  and it will result into a metric  'metricname[tag1=valu1][tag2=value2][host=abc]' want to extract the host part so that I can pass it into another ts() like this:

ts("metricname2", host=abc).

any thoughts? Thanks

Correct Answer by jason_goocher on Apr 21, 2017 12:03 PM

Alright I think we're in business now!

Link: https://workday.wavefront.com/u/skxmB5RDjZ

There were two small issues that needed to be addressed. The avg() function on the first query was not grouped by anything, so it would not return data when trying to do series matching. Per the original response, you'd need to group by "sources" typically. So something like:

avg(ts("metricname", tag1=value1 and tag2=value2), sources)

However, it seems that you want to match by "cname", so we'll change the group by for that to:

avg(ts("metricname", tag1=value1 and tag2=value2), cname)

The final change that needed to happen is applying a group by clause to the second query as well. Since it still includes point tag information, we need to strip that out as well. Now both queries are grouped by cname and should return data as expected. My apologies for not mentioning that from the start.

Please let me know if this helps!

Thanks,

Jason

[bradleyka93]

Re: Extracting pointTagKey and associated value

jason_goocher  Apr 21, 2017 9:18 AM (in response to shivender_devarakonda_workday_com)

Hi shivender_devarakonda_workday_com,

I think I have the proper solution for you, but it's hard to say for sure without having a shortened URL to test. However, I believe you should be able to accomplish this without the need of aliasSource(). If I'm correct in my understanding, you'd like to limit the results of your 2nd query based on the sources (hosts) reporting data in your 1st query. Wavefront has a functionality we refer to as Series Matching. I think this is what you'll want to utilize.Series Matching will match up series across multiple queries. Series Matching requires all parameters to match though (e.g. point tag key/value and source (host) name). Let me provide you with what I believe is the proper solution, and then I'll provide an explanation:

(avg(ts("metricname", tag1=value1 and tag2=value2), sources) * 0) [+] ts("metricname2")

The first thing to highlight is the [+]. When using operators such as +, series matching will occur when there are two or more series associated with each query. However, if one query only has 1 series, then that single series will be applied to all other series in the other query. Here is a good example of this:

Series1A|B|C * Series2B|C|D = B|C

Series1A * Series2A|B|C = A|B|C

In the first example, there are 2+ series in each query and series matching occurs. Since B|C are the only overlapping series, those are the only ones returned. In the second example, the first query only has A. Due to this, series matching will not occur and Series1A will return results for reporting series in Series2 (A|B|C). If you'd like for series matching to always occur, but the first query is dynamic and could possibly be a single series, the [] will force series matching.

Series1A [*] Series2A|B|C = A

Series matching requires all parameters to match. This means that if point tags are present, they will also need to be the exact same (along with source name) in order to match up properly. I'm making an assumption that sources reporting data for "metricname" also report data for"metricname2". However, if that source includes point tag key|value(s) for "metricname" but not "metricname2", then they won't match up under series matching. If this assumption I made is correct, then the way around this is to artificially strip out the point tag key|value(s) from "metricname". In the query I provided above, I do this by applying avg(, sources) on top of ts("metricname", tag1=value1 and tag2=value2). The resulting data will no longer reflect point tag values in this case.

Finally, my assumption is that you only want to see values for ts("metricname2") by themselves. The way to do this is to force series matching to occur, but not enable values for the first query to alter values for the second query. By multiplying avg(ts("metricname", tag1=value1 and tag2=value2), sources) by zero, it will return all series (grouped by source), but turns the reported values to zero. Then it's essentially doing zero [+] A|B|C.

If you'd like to provide a shortened URL that includes the query for ts("metricname", tag1=value1 and tag2=value2) and ts("metricname2"), then I can test it out directly to ensure it's the proper solution. If you share the shortened URL in this thread, it will only be accessible by team members that are part of your organization, as well as internal employees at Wavefront.

Thanks,

Jason

[bradleyka93]

shivender_devarakonda_workday_com  Apr 21, 2017 10:16 AM (in response to jason_goocher)

Thanks for providing your input!

I got the following error:

• sunnylabs.query.QuerySyntaxException: Query syntax error: Inner join yielded no results

The two metrics I referred as "metricname" and "metricname2"  will have different point tag key values for at least one point tag key.

Adding some more details to the earlier example:

Source: ts("metricname", tag1=value1 and tag2=value2)  - returned metric has "metricname [tag1=value1] [tag2=value2] [host=abc]"

I want to take only host part and apply to the target query

target: ts("metricname2", host=abc) - returned metric will be like "metricname2 [tag1=value3][host=abc]"

Thanks

[bradleyka93]

Re: Extracting pointTagKey and associated value

jason_goocher  Apr 21, 2017 10:20 AM (in response to shivender_devarakonda_workday_com)

Could you please share a shortened URL link so we can investigate further?

Thanks,

Jason

[bradleyka93]

Re: Extracting pointTagKey and associated value

shivender_devarakonda_workday_com  Apr 21, 2017 10:25 AM (in response to jason_goocher)

https://workday.wavefront.com/u/MP80Fzftgy , Please refer to the chart titled "*queue size (Not Ready)" in last but one metric row.

[bradleyka93]

Re: Extracting pointTagKey and associated value

jason_goocher  Apr 21, 2017 10:43 AM (in response to shivender_devarakonda_workday_com)

Thank you for sending over that shortened URL! The chart you referred to currently includes only a single query (a.k.a. "metricname"). Could you add the secondary query to that chart temporarily (a.k.a. "metricname2")? I think I know what the issue is, but still can't confirm unless I have both queries to play with.

Thanks!

[bradleyka93]

Re: Extracting pointTagKey and associated value

shivender_devarakonda_workday_com  Apr 21, 2017 11:05 AM (in response to jason_goocher)

It has both queries already, can you please check? thanks

[bradleyka93]

shivender_devarakonda_workday_com  Apr 21, 2017 11:06 AM (in response to shivender_devarakonda_workday_com)

I am interested to take cname[] from the first query and apply it to the second query.

[bradleyka93]

Re: Extracting pointTagKey and associated value

jason_goocher  Apr 21, 2017 11:46 AM (in response to shivender_devarakonda_workday_com)

Hi shivender_devarakonda_workday_com,

I still only see 1 query associated with the chart "queue size (Not Ready)": https://workday.wavefront.com/u/bsvwvrmn6K

Am I looking at the correct chart?

Thanks,

Jason

[bradleyka93]

Re: Extracting pointTagKey and associated value

shivender_devarakonda_workday_com  Apr 21, 2017 11:54 AM (in response to jason_goocher)

It looks like the link you have shared is not getting updated, can you please check again here? https://workday.wavefront.com/u/M7YFmGRPbv

https://workday.wavefront.com/u/M7YFmGRPbv

Thanks

[bradleyka93 · Accepted solution]

Re: Extracting pointTagKey and associated value

jason_goocher  Apr 21, 2017 12:03 PM (in response to shivender_devarakonda_workday_com)

Alright I think we're in business now!

Link: https://workday.wavefront.com/u/skxmB5RDjZ

There were two small issues that needed to be addressed. The avg() function on the first query was not grouped by anything, so it would not return data when trying to do series matching. Per the original response, you'd need to group by "sources" typically. So something like:

avg(ts("metricname", tag1=value1 and tag2=value2), sources)

However, it seems that you want to match by "cname", so we'll change the group by for that to:

avg(ts("metricname", tag1=value1 and tag2=value2), cname)

The final change that needed to happen is applying a group by clause to the second query as well. Since it still includes point tag information, we need to strip that out as well. Now both queries are grouped by cname and should return data as expected. My apologies for not mentioning that from the start.

Please let me know if this helps!

Thanks,

Jason

1 of 1 people found this helpful

[bradleyka93]

shivender_devarakonda_workday_com  Apr 21, 2017 12:19 PM (in response to jason_goocher)

Sure, thanks!