topic Calculating math on three different searches in Getting Data In

Calculating math on three different searches

labaningombam — Thu, 30 Nov 2023 06:38:19 GMT

Hi,

I need to write a query to find the time remaining to consume events.

index=x message.message="Response sent" message.feedId="v1" | stats count as Produced

index=y | spath RenderedMessage | search RenderedMessage="*/v1/xyz*StatusCode*2*"| stats count as Processed

index=z message.feedId="v1" | stats avg("message.durationMs") as AverageResponseTime

So I want to basically perform:
Average Time left = Produced - Processed /AverageResponseTime

How can I go about doing this?

Thank you so much

Re: Calculating math on three different searches

ITWhisperer — Thu, 30 Nov 2023 09:24:00 GMT

You could try something like this

index=x message.message="Response sent" message.feedId="v1" | stats count as Produced | appendcols [ search index=y | spath RenderedMessage | search RenderedMessage="*/v1/xyz*StatusCode*2*"| stats count as Processed] | appendcols [ search index=z message.feedId="v1" | stats avg("message.durationMs") as AverageResponseTime] | eval AverageTimeLeft = (Produced - Processed) * AverageResponseTime

Note that I think your calculation should be a multiplication not a division

Re: Calculating math on three different searches

labaningombam — Thu, 30 Nov 2023 09:45:41 GMT

Thank you so much for the correction as well 🙂

This worked.