Top Loggers?

[DocMAX]

Can i get a list of "top loggers" by process in a timeframe?

[tstack]

Log analysis in lnav is mostly done using the SQLite interface. You can write a SQL query that operates on the columns defined in a given log format. For instance, if your format defines the process and logger columns, you can write a SELECT query that uses a GROUP BY clause with those columns. To divide up the result by time slices, you can use the timeslice() function to round timestamps to a slice.

Putting it all together, the query might look something like this:

;SELECT timeslice(log_time_msecs, '5m') AS slice, process, logger, count(1) AS c FROM myapp_log GROUP BY slice, prc, fi ORDER BY slice, process, c DESC

This will query the messages that match myapp_log log format, convert the timestamps to five minute slices, get the process and logger names, and aggregate the results into a count. Then, the result set will be ordered by the time slice, process name, and count.