Ok I have done the following:
Query A
from(bucket: “telegraf”)
|> range(start: v.timeRangeStart, stop: v.timeRangeStop)
|> filter(fn: (r) => r[“_measurement”] == “win_services” and r[“_field”] == “state”)
|> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)
|> yield(name: “mean”)
Query B
from(bucket: “telegraf”)
|> range(start: v.timeRangeStart, stop: v.timeRangeStop)
|> filter(fn: (r) => r[“_measurement”] == “win_services”)
|> filter(fn: (r) => r[“_field”] == “startup_mode” and r._value == “2”)
|> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)
|> yield(name: “mean”)
As I am using Grafana for visualisations and alerting - I sued a Series Override for “Startup_mode” hidden series - this omitted it from the graph and also the alert.
Now to the next tweak - within the alert I receive the following:
[Alerting] Service Alert
Service Down Service is set to automatic but not currently in running state.
| ##### Metric name | ##### Value | |
|---|---|---|
| — | — | |
| ##### state {display_name=ASP.NET State Service, host=lo1wpcewtweb01, service_name=aspnet_state} | ##### 1.000 |
Where we have the Value of 1.000 is it possible to change that within the query so it shows as “Stopped” ?
I have had a look at " Conditionally transform column values with map()" but with no success, my query is below but it takes a long time to execute and no change on the results
from(bucket: “telegraf”)
|> range(start: v.timeRangeStart, stop: v.timeRangeStop)
|> filter(fn: (r) => r[“_measurement”] == “win_services” and r[“_field”] == “state”)
|> map(fn: (r) => ({
r with
level:
if r._value == 1 then “stopped”
else if r._value == 2 then “pending”
else “running”
})
)
|> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)
|> yield(name: “mean”)
Below is what is shown in the legend
win_services state {display_name=“ASP.NET State Service”, host=“MyServer”, service_name=“aspnet_state”} Current 1.000
If anyone could guide on this please?
