demmer

// main.juttle created 10-6-2014
demo cdn -from :15 minutes ago: -to :now: 
-every :5 second: -period :2 seconds: -batch_size 250
| reduce count=count() by host,type,name
| @table

demmer

Live Data, Meet Historical

Jut lets you analyze live data, historical data or both. This showcase taps into response time data from our synthetic demo generator to combine the last two minutes of history with the live firehose.

Your Turn:

• Line 2: Change the -from time to :5 minutes ago:
• Line 4, 6 & 7: Change "service" to "host"
• Line 3: Change the batch interval to :5 seconds:

demmer

Events, Meet Metrics

You shouldn't have to go to separate applications for different data types. Juttle allows you to seamlessly combine events like log data, code deploys, and change windows with metrics like CPU, memory, disk or statsd and JMX metrics.

This example plots a typical metric (response time) and overlays server errors combed from logs on the host "sea.0" as vertical bars.

demmer

There's a reducer for that...

What query language hasn't left you wanting of just a few more functions? The Juttle dataflow language comes with powerful built-in functions like percentile() but you can define your own functions or reducers that operate on every point in a stream or on batches of points. You can also import functions that other people have written.

In this example, we implement an exponentially weighted moving average calculation and import a rate of change calculation.

Your Turn:

• Try changing the weight used in the ewma function by changing .1 to .9 on line 16.
• On line 7, we've imported a derivative reducer. Let's plot what it does by uncommenting line 20.

demmer

Split and Join Flowgraphs

Juttle programs enable you to answer questions in dynamic, changing environments by letting you split a stream of data, run different computations on each stream, and then join the two streams together again. These dynamic programs continually update their results, allowing you to follow hotspots around your environment or use one program output as a key for others.

This example finds the slowest host in the "search" service based on response time, every 10 seconds, and then gets a count of user requests running on that particular host.

Your Turn:

• Try changing the service from "search" to "index".
• Let's make sure we are in fact getting showing the slowest host:
• Uncomment line 21

demmer

Live Joins

Juttle's powerful join functionality allows you to join your local data with data stored anywhere else. What's more, you can do streaming joins where points are joined as they come in.

Here we're counting the number of server errors triggered by each user_id and joining that data to an external customer data file.

Your Turn:

• Try changing "first_name" to "last_name" on lines 11 and 12
• Check out the raw data from the two data sources by commenting out line 18 and adding "@table" on line 19

demmer

Juttle Wordcloud

This gist adapts a wordcloud visualization from http://www.jasondavies.com/wordcloud/ as a Juttle view, adding transitions between batches for updates.

As a silly little showcase, the demonstration program calculates a frequency count of words from Dr Seuss' "The Cat in the Hat" (text pulled from http://paulandlizdavies.com/poems/cat.htm) by splitting the words from each page into separate points, then counting the words by frequency and showing them in the wordcloud and a barchart.

demmer

#!/usr/bin/env node
//
// Converts a git log into a JSON array including the full commit message.
//

var cp = require('child_process');

var formats = {
    author: '%an',
    email: '%ae',

demmer

// Simple juttle program to show a big metric tile counting down the time until
// the launch of playground

const launch = :2014-12-10 12:10:14 PST:;

function format(value) {
    var days = Duration.get(value, 'day');
    var hours = Duration.get(value, 'hour');
    var minutes = Duration.get(value, 'minutes');
    var seconds = Duration.get(value, 'seconds');

demmer

// Prompt for a time duration and a threshold parameter
input duration: duration -label 'Time period';
input threshold: number -label 'Max response time (ms)' -default 500;

// Use these inputs to filter out only hosts that have experienced high response times
// during the specified time period.
input host: combobox -juttle "read -demo 'srch_cluster' -last :${duration}: name = 'response_ms' | filter value > ${threshold} | reduce by host"
    -valueField 'host' -label 'Hosts with response time > ${threshold} ms';

// Once a host is selected, show the response time chart