Aggregations

Key concepts

Time series

A single metric can have multiple time series. For example, if you are looking at a host CPU system usage metric, You can see many time series for that metric: one time series for each monitored host. These time series can be aggregated for further analysis, such as to show the average CPU system usage across a set of hosts.

Time buckets

Time series data is aggregated into buckets to optimize the number of data points that are shown on a graph. For example, a sensor might report a CPU usage data point every second. To show a graph of CPU usage over an hour, these raw data points are aggregated into 5 second buckets where the value for the bucket is derived from the 5 raw data points (such as the mean). Then each bucket value is rendered on the chart. If you zoom out and show a chart over a larger time range, a different bucket size is used to optimize the appearance of the chart. For big number widgets, all the raw data points that fall into the specified time window are added to one bucket and then aggregated, which results in a single value for the time window.

Metric types

There are two broad categories of infrastructure metrics that can be monitored by Instana - meters and gauges. A meter is something where the value will change depending on how frequently you sample it, while a gauge's value will be independent of the sampling frequency. An example of a meter is number of bytes transferred, where the meter gives the delta from the last time it was sampled. An example of a gauge is total available memory. A counter can be exposed as a gauge if it returns the total count when it's sampled, or it can be exposed as a meter if it returns the delta from the last time it was sampled.

Depending on the type of metric you are looking at, you might be interested in different aggregations. If you are looking at a meter, it might be useful to see the total sum of the metric. For example, in the case of the bytes transferred, you might want to see the total number of bytes that have been transferred in a time range. However, for gauges, seeing the total number is less useful because the sum is highly dependent on the sampling frequency that is used. In that case, it might be more useful to use a mean over time.

Cross-time aggregation (time aggregation)

Within a time series, data points are aggregated across various time spans or buckets based on a statistical method. Instana supports mean, max, min, sum and percentile calculations for cross-time aggregations.

Rate aggregation

In addition, Instana supports rate aggregations for calculating rates of counters. The rate function returns the change rate of a counter every second. The rate function is used only for counters because it automatically accounts for counter resets and expects only monotonically increasing values.

Cross-series aggregation (spatial aggregation)

When a metric contains several time series of data, it is often more meaningful for users to see the aggregated (reduced) data as a single time series. In most cases, cross-series aggregation is the same as cross-time aggregation, that is, Instana takes all the data points for all the series, and performs a single aggregation over these data points. However, in some scenarios, it might be meaningful for users to select a different aggregation method across different series. At the moment, Instana supports only selecting a sum cross-series aggregation for mean and rate time-series aggregations. This type of aggregation is useful for analyzing gauges, where summing over time doesn't give an intuitive result. To use it, click Use sum for cross-series aggregation on the Instana user interface when you configure the metric aggregation.

Cross-series sum

Aggregations example

To provide some more intuition about how Instana aggregates across time and across series, the following table gives a few time series with some values, and then gives some aggregation examples.

Description Values
CPU A [1, 3, 3, 0, 7, 2, 4, 4, 0, 2]
CPU B [2, 3, 3, 0, 7, 2, 4, 4, 0, 2]
CPU C [3, 3, 3, 0, 7, 2, 4, 4, 0, 2]
Merged series [A, B, C] [1, 3, 3, 0, 7, 2, 4, 4, 0, 2, 2, 3, 3, 0, 7, 2, 4, 4, 0, 2, 3, 3, 3, 0, 7, 2, 4, 4, 0, 2]
Mean of merged series (1+3+3+0+7+2+4+4+0+2+2+3+3+0+7+2+4+4+0+2+3+3+3+0+7+2+4+4+0+2) / 30 = 2.7
Sum of Merged Series (1+3+3+0+7+2+4+4+0+2+2+3+3+0+7+2+4+4+0+2+3+3+3+0+7+2+4+4+0+2) = 81
Cross-series sum of averages (see as follows) avg(CPU A) + avg(CPU B) + avg(CPU C) = 2.6 + 2.7 + 2.8 = 8.1
P90 Sorted is [0, 0, 0, 0, 0, 0, 1, 2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 4, 4, 4, 4, 4, 4, 7, 7, 7], 90th percentile is 4.

Last bucket aggregation

When the last data point from a data series is displayed, the Metric is aggregated on the smallest most recent unit of time. This feature is available for Big Number, Pie Chart, Top List, and Table widgets. To enable the last bucket aggregation, toggle the Use last value on the configuration of a data set for an Infrastructure metric.

last_bucket_aggregation.png