20

I'm using graphite to collect data, and I'd like to retrieve the total count of certain events over a period of time. Say, number of logins per week.

However, I just need the total number, and don't need to see how it evolves over time.

When I use something like from=-1w&target=summarize(stats.events.login.success,"1w")&format=json then I still get two datapoints, and not one.

Is there a way to get a single datapoint from the summarize function? or use a different function to return a single datapoint value?

gingerlime
  • 5,206
  • 4
  • 37
  • 66

2 Answers2

27

The problem here is that summarize doesn't align to the from field by default.

summarize(seriesList, intervalString, func='sum', alignToFrom=False)

If you do

from=-1w&target=summarize(stats.events.login.success,"1w","sum",true)&format=json

you should get just one datapoint. What it's doing right now is aligning your buckets to dates that don't fit within the week range starting from your from parameter, so you end up with 2 buckets. From the graphite docs on summarize:

By default, buckets are caculated by rounding to the nearest interval. This works well for intervals smaller than a day. For example, 22:32 will end up in the bucket 22:00-23:00 when the interval=1hour.

Passing alignToFrom=true will instead create buckets starting at the from time. In this case, the bucket for 22:32 depends on the from time. If from=6:30 then the 1hour bucket for 22:32 is 22:30-23:30.

mmrobins
  • 12,809
  • 7
  • 41
  • 42
  • Thanks @mmrobins. I figured this out by trial and error, but didn't get a chance to update the answer here. I have to say, having read the documentation several times, I still don't fully understand it (particularly why is this different for intervals smaller than 1 day, but not larger...) – gingerlime Nov 30 '12 at 09:11
  • I don't think it's different for smaller intervals, just more intuitive. The thing is for week intervals it's less intuitive where the bucket should start. At least for me, it seems to bucket on Thursdays when summarizing at the week level, which definitely not an intuitive day. When by month it's bucketing on what appears to be th 16th of each month. I'm not sure how they decide where to create the buckets at intervals larger than a day, but it's definitely not what I'd expect, so I have to set alignToFrom=true most of the time when using larger intervals. – mmrobins Nov 30 '12 at 17:53
  • Yes, maybe it's just me, but it makes more sense to me to align it by default, and have it misaligned / rounded only if you require it rather than the other way around. Maybe the thinking is that if you want summary by hour, you want it aligned to the exact hour of day (14:00, 15:00 etc) rather than at hourly intervals from the current time. However the same logic doesn't apply to longer periods like weeks. Anyway, as long as I know how to resolve it I'm reasonably happy. Thanks again for your help @mmrobins. – gingerlime Dec 01 '12 at 11:42
0

So for me it divides the week on Wednesday and the month on the 15th, 16th or 17th. Additionally mine seems to be ignoring the alignToFrom value. Co-worker had the idea that maybe it's based on the install date or when the whispher db is first instantiated. Where I can believe that may be the case for day of the week, I doubt we both installed things mid month.

Jeffe
  • 1
  • Nevermind, fixed the not honoring the alignToFrom, I had to wrap the value in quotes. i.e. just doing a straight up "true". But still the default value is very weird. – Jeffe Dec 17 '12 at 21:07