You are misunderstanding the purpose of sum. It is not performing a sum over time but over the dimensions of your metric.
In your example, assuming there are multiple requests metrics (with a dimension page by exemple), rate(requests[3 sec]) will give you (at some point in time):
{page="A"} 12.4
{page="B"} 1.5
{page="C"} 0 .... (and so on for each metrics requests with different label set)
The sum function will sum the values of the different rates; and sum(rate(requests[3 sec])) will give you only one value:
{} 42.13 <-- the sum of all rate(requests[3s]) values
BONUS: In the case you metric have multiple dimensions (represented by multiple labels in your metric) you can tell sum() to operate on a subset of them: sum(rate(requests[3 sec])) ON(foo)
rate/sum confusion
Prometheus: how to rate a sum of the same counter from different machines? - Stack Overflow
promql - Prometheus sum by rate give crazily high spike - Stack Overflow
sum(rate(metricselector[rangevector])) over-represents short lived timeseries
Can rate() be used with all types of Prometheus metrics?
How do you calculate request rates using the Prometheus rate function?
How does the Prometheus rate() function differ from increase()?
Hi,
So I'm struggling with summing up bandwidth usage on my firewalls. Without going into too much detail, I'm using Prom to receive the snmp stats for bandwidth use on multiple interfaces of my FW (over 15 at last count). This works fine when graphing in Grafana.
rate(ifHCOutOctets{ifIndex="500010723",instance="10.1.2.3",job="Firewalls",name="Firewall-1"}[30s]) * 8
rate(ifHCOutOctets{ifIndex="500010724",instance="10.1.2.3",job="Firewalls",name="Firewall-1"}[30s]) * 8
rate(ifHCOutOctets{ifIndex="500010725",instance="10.1.2.3",job="Firewalls",name="Firewall-1"}[30s]) * 8
This works great and when using a graph configured for bits per second, gives me a nice overlaid graph of every interface's bandwidth use over the day, identifying which interface (and connected agency) is rinsing the bandwidth.
What I'm looking for now is a concatination of the day's bandwidth use. I know I'm going to be needing a sum and from reading this: https://www.robustperception.io/rate-then-sum-never-sum-then-rate, it seems that rate should not come first. However, this: https://prometheus.io/docs/prometheus/latest/querying/functions/#rate says exactly the opposite (as far as I'm understanding it - "Note that when combining rate() with an aggregation operator (e.g. sum()) or a function aggregating over time (any function ending in _over_time), always take a rate() first, then aggregate. Otherwise rate() cannot detect counter resets when your target restarts."
So, I was struggling initially but now I'm even more confused. In my mind, I want this:
sum(rate(ifHCOutOctets{ifIndex="500010723",instance="10.1.2.3",job="Firewalls",name="Firewall-1"}[30s]) * 8 + rate(ifHCOutOctets{ifIndex="500010724",instance="10.1.2.3",job="Firewalls",name="Firewall-1"}[30s]) * 8)
and so on so that I can see the total bandwidth in use at the time on all interfaces. I can then use that to graph a 24 hour period and see if all interfaces combined are topping out our bandwidth allowance.
Thanks for any pointers you can offer.
You'd better expose your counters at 0 on application start, if the other labels (aaa, etc) have a limited set of possible combinations. This way rate() function works correctly at the bottom level and sum() will give you correct results.
If you have to do a rate() of the sum(), read this first:
Note that when combining
rate()with an aggregation operator (e.g.sum()) or a function aggregating over time (any function ending in_over_time), always take arate()first, then aggregate. Otherwiserate()cannot detect counter resets when your target restarts.
If you can tolerate this (or the instances reset counters at the same time), there's a way to work around. Define a recording rule as
record: job:mycounter:sum
expr: sum without(instance) (mycounter)
and then this expression works:
sum(rate(job:mycounter:sum[5m]))
The obvious query rate(sum(...)) won't work in most cases, since the resulting sum(...) may hide possible resets to zero for individual time series, which are passed to sum. So usually the correct answer is to use sum(rate(...)) instead. See this article for details.
Unfortunately, Prometheus may miss some increases for slow-changing counter when calculating rate() as shown in the original question above. The same applies to increase() calculations. See this issue, this comment and this article for details. Prometheus developers are going to fix these issues - see this design doc.
In the mean time try to use VictoriaMetrics when you need exact values for rate() and increase() functions over slow-changing counter (and distributed counter).
Hello,
I have this graph monitoring the bandwidth of a VLAN on a switch every 1m using SNMP Exporter, but I also what to get the total/sum data over time, so if I select the last hour it will show x amount inbound and x amount outbound.
sum by(ifName) (irate(ifHCInOctets{instance=~"192.168.200.10", job="snmp_exporter", ifName=~".*(1001).*"}[1m])) * 8My current graph:
I'd like to duplicate and create a stat panel show how much data in total has passed over what period I choose that's all.
For the metric I'm not sure whether to use bytes(SI) or bytes(IEC), but are similar if I change to either.
Not sure how to calculate this, but I have this created for the past 1 hour.
by copying the PromQL in Grafana and changing to a stat panel and then editing to use this:
Not sure if this is ok as I'm not sure how to calculate it all, maths was never my best subject.
Any help would be great.
I think something like is close: with sum_over_time
sum by(ifName) (sum_over_time(ifHCInOctets{instance=~"192.168.200.10", job="snmp_exporter", ifName=~".*(1001).*"}[1m])) * 8but it comes back as 85.8 Pib when it should be 85.8 TB with my calculations.
EDIT
Observium:
What Grafana shows