Struggling to understand what Telegraf is doing

Telegraf
,
1

I have a Cisco WLC that’s sending telemetry to Telegraf and I have a config file that is outputting to text file and InfluxDB2.0 at the same time.

I’ve been trying to write a simple query to display data in a table that ‘resembles’ how I would do it inside of Excel, so that I can wrap my head around how to display the same data in Grafana. I implemented the text file output to help me ‘see’ what was really being sent to InfluxDB.

However, I’m not seeing what I would expect when trying to correlate the contents of the text file to the query results in InfluxDB. Therefore, I believe I need to sort out that before I can take the next step in understanding how to accomplish my ultimate goal.

The text file contains x number of ‘records’ but InfluxDB doesn’t match. The text file contains lines like the following (20 total: 10 for one source, and 10 for the other):

iosxe_system,bay=0,chassis=1,fru=fru-rp,host=cisco-virtual-machine,path=Cisco-IOS-XE-platform-software-oper:cisco-platform-software/system-usages/system-usage,slot=0,source=9800-4,subscription=38 process_system_usages/process_system_usage/pid=4120i,process_system_usages/process_system_usage/name="linux_iosd-imag",process_system_usages/process_system_usage/total_run_time=966795i,process_system_usages/process_system_usage/five_seconds=1i,process_system_usages/process_system_usage/allocated_memory=368701i,process_system_usages/process_system_usage/allocated_memory_percent=2i 1695733687353000000
iosxe_system,bay=0,chassis=2,fru=fru-rp,host=cisco-virtual-machine,path=Cisco-IOS-XE-platform-software-oper:cisco-platform-software/system-usages/system-usage,slot=0,source=eWLC-4,subscription=48 process_system_usages/process_system_usage/pid=4294i,process_system_usages/process_system_usage/name="linux_iosd-imag",process_system_usages/process_system_usage/total_run_time=2982323i,process_system_usages/process_system_usage/five_seconds=3i,process_system_usages/process_system_usage/allocated_memory=347657i,process_system_usages/process_system_usage/allocated_memory_percent=1i 1695734476488000000

But the following query returns only two records (in 2 tables, which I don’t understand as I would expect these to be in a single table):

from(bucket: "testing")
	|> range(start: v.timeRangeStart, stop: v.timeRangeStop)
  |> filter(fn: (r) => r["_field"] == "process_system_usages/process_system_usage/allocated_memory")

Looking to understand:

  1. Why I don’t see the other records in InfluxDB (I tried to attach text file, but I’m a new user so I couldn’t. Can provide through some other means if required)
  2. Why does InfluxDB consider the data as being in 2 tables

Any help would be much appreciated!!

Thanks!

Steve

2

Hello @skimof671,
This post might help you understand Group keys better:

Basically because your source and subscriptions are tags and they are part of the group key they’re going to be in different tables.

To put everything in one table add a

|> group()

To the end of your query.

3

Good morning @Anaisdg

I’ll check out the post and try the grouping to see if that helps!

Thank you!