Graylog2 / Graylog2/graylog2-server

Add Functionality to chooses unique fields over a time period.

Open
#9,317 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?
When creating dashboards for something like Package Size, there is a process which runs more than 1 time a day, which collects the field. When you do a Sum over the Package Size, it will take both log messages, or many and sum up the bytes of the same package, creating the total size to be double or triple.

Example:
Screen Shot 2020-10-30 at 7 54 04 AM

And this is behind the data:
Screen Shot 2020-10-30 at 7 53 55 AM

Where on the second screenshot you can see the package is counted 2 times, and getting the total doubled. So need a way to get there to be only one counted in the first screenshot.

## Why?
Create dashboards of sum data, when a process/logs are repeated more than one time in a time window.

## Your Environment

* Graylog Version: 3.3.8

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.