Raw_history() function

raw_history() — Returns raw history samples without any bucketing.

Syntax

The raw_history() function returns returns a tree, and takes a tree parameter. It can take 2 optional string parameters:

tree raw_history(tree input[,string input[,string input]])

Return value

The raw_history() function returns raw, unbucketed history.

Description

The raw_history() function produces raw history without any bucketing, in contrast to the history() function which returns bucketed history data. The results of the raw_history() function include the current value, if the current value was first observed within the time range indicated.

Examples

You can try the following examples against your own data in the GoToAssist search field, or against fictitious data in the Query Sandbox:

• Example 1: Find raw traffic history
• Example 2: See history within a time range
• Example 3: Find raw traffic history over time range
• Example 4: Find disk space history

Example 1: Find raw traffic history

This simple query spits out the raw traffic history data without bucketing.

Query: Show me interface history from yesterday until an hour ago.

SELECT raw_history(val)
FROM /network/device/interface/in_octets

Results: Depending on the database, this query returns results similar to this:

row
  raw_history(val)
    history
       when 2008-05-07T18:43:21.903190Z
       value 2345284942
row
  raw_history(val)
    history
       when 2008-02-21T19:10:40.385213Z
       value 886884854
    history
       when 2008-02-21T19:15:57.339829Z
       value 912078686
    history
       when 2008-02-21T19:21:00.785734Z
       value 926937223 
   . . .

Example 2: Find raw traffic history over time range

Query: Show me the history from yesterday until an hour ago.

SELECT raw_history(val, '1 day ago', '1 hour ago')
FROM /network/device/interface/in_octets

Results: Depending on the database, this query returns results similar to this:

row
   raw_history(val, 2 hours ago, 1 hour ago) 
row
   raw_history(val, 2 hours ago, 1 hour ago) 
row
   raw_history(val, 2 hours ago, 1 hour ago) 
row
   raw_history(val, 2 hours ago, 1 hour ago) 
   . . .

Example 3: Find raw traffic history over time range

You can limit the raw history output that you get, both forwards and backwards, by using the LIMIT reserved word.

Query: Show me the history from yesterday until an hour ago.

SELECT raw_history(val, '1 day ago', 'now', LIMIT => 5)
FROM /network/device/interface/in_octets

Results: Depending on the database, this query returns results similar to this:

row
   raw_history(val, 2 hours ago, 1 hour ago) 
row
   raw_history(val, 2 hours ago, 1 hour ago) 
row
   raw_history(val, 2 hours ago, 1 hour ago) 
row
   raw_history(val, 2 hours ago, 1 hour ago) 
row
   raw_history(val, 2 hours ago, 1 hour ago)
 

Example 4: Find disk space history

This example searches for the raw history of free disk space on each system.

Query: Show me the history of disk space on each system.

SELECT raw_history(systemname) 
FROM %free disk space% 
WHERE description = 'Local Fixed Disk'

row
  raw_history(systemname)
    history
       when: 2008-05-06T22:04:59.303326Z
       value: ENGLAP032
row
  raw_history(systemname)
    history
       when: 2008-05-06T21:54:54.207658Z
       value: ENGLAP036
row
  raw_history(systemname)
    history
       when: 2008-05-05T22:04:26.795989Z
       value: ENGLAP033
    . . .

To see other PQL functions, see Functions.

Related topics

• Functions
• Operators
• Expressions
• Read about PQL

| Views: 1084 | Last Updated: Thu, May 09 2013 2:28 PM

Is this article helpful?