so, I am trying to parse out syslog stats data, trying to get a velocity of the events to figure out which log source is spiking when backlogs occur.
events: the count of events for a particular source type
src: the individual device sending logs to the syslog server.
as syslog stats don't reset until syslog is hup'd or otherwise restarted taking the list of events isn't specifically helpful.
So what I'm trying to figure out is how to get a velocity of trying to get something like: stats min(events, by source) and compare it to a stats max(events) by src. However I haven't been able to combine this properly.
Output would preferably be a table that has (src, maxevents, minevents, diff)
↧