Reputation: 145
I am trying to create a table/chart in Grafana showing the total number of unique users who have logged in to a given application over a given time range (e.g. last 24 hours). I have a metric, app_request_path
which records the number of requests hitting a specific path per minute:
app_request_count{app="my-app", path="/login"}
This gives me the following:
app_request_count{app="my-app",path="/login",status="200",username="username1"}
app_request_count{app="my-app",path="/login",status="200",username="username2"}
Now I want to count the number of unique usernames, so I run:
count_values("username", app_request_count{app="my_app", path="/login"})
and I get:
{username="0"}
{username="1"}
{username="2"}
{username="3"}
{username="4"}
{username="5"}
What am I missing / what am I doing wrong? Ideally I'd like to get a single scalar value that display the total number of unique usernames who have logged in in the past 24 hours.
Many thanks.
Upvotes: 10
Views: 23519
Reputation: 17830
The following query should return the number of unique username
label values encountered during the last 24 hours for the given labels app="my-app"
and path="/login"
:
count(
group(
last_over_time(app_request_count{app="my-app", path="/login"}[24h])
) by (username)
)
How it works:
The inner last_over_time(...[24h])
query makes sure that every unique time series is selected for the last 24 hours, even if this time series stopped receiving new samples during the last 24 hours. See last_over_time() docs.
The group(...) by (username)
returns a single time series per each unique username
label. See group() docs.
The count(...)
returns the total number of time series returned from group()
. This number matches the number of unique values for username
label. See count() docs.
Upvotes: 3
Reputation: 34122
count without (username)(app_request_count)
count_values
is for metric values, count
is for time series. It's also not advised to have something like usernames as label values as they tend to be high cardinality. They may also be PII, which could have legal implications.
Upvotes: 12