Query to get ethernet usage

1

Hi all, I’m currently using this query to get the usage in bytes of my eth interfaces.

from(bucket: "arista")
  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)
  |> filter(fn: (r) => r["source"] == "192.168.1.20")
  |> filter(fn: (r) => r["name"] == "Ethernet7" or r["name"] == "Ethernet8" or r["name"] == "Ethernet48")
  |> filter(fn: (r) => r["_measurement"] == "inOctets")
  |> derivative(unit: 1s, nonNegative: true, columns: ["_value"], timeColumn: "_time")   
  |> group(columns: ["source"])
  |> map(fn: (r) => ({
        r with
        _value: r._value * 8.0
      })
    ) 
  |> aggregateWindow(every: v.windowPeriod, fn: sum, createEmpty: false)
  |> yield(name: "sum")

My doubt is on the aggregateWindow. Do I have to use the sum or last function?
Also, I don’t understand why if I use a wider time range (from 1h to 6h) all data increase its size (look at the pointer hour and value)… Is the query wrong?

1320×651 79.5 KB

1338×717 94.4 KB

2

Hello @stefanoromanello,
It increases in size because you’re using the
every: v.windowPeriod parameter which is relative to the duration back in time that you’re querying. The windowPeriod will scale accordingly. So if you query for an hour the windowPeriod might be 10m where if you query for 6h it might be an hour. You can change the every parameter to be a constant of your choice like:

|> aggregateWindow(every: 10m, fn: sum, createEmpty: false)