topic Re: Time and Duration Dashboard in Alerting

Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 08:56:59 GMT

Hi everyone,

I currently have three dashboards that show the same processes in three states "Ready To Process" , "Processing" and "Complete"

How can I create one other dashboard that shows the duration it takes from "Processing" to "Complete"

Re: Time and Duration Dashboard

ITWhisperer — Wed, 28 Oct 2020 09:23:23 GMT

Can you provide some sample data and the queries you currently have?

Re: Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 09:51:28 GMT

here are the three queries

here's a sample data

Re: Time and Duration Dashboard

ITWhisperer — Wed, 28 Oct 2020 10:11:20 GMT

Which part of the data uniquely identifies the process instance id? uuid? name? rootRun? Are any of these already extracted (as interesting fields)?

Re: Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 10:14:35 GMT

yes, business_field is the name of the process

Re: Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 10:16:07 GMT

name=process and is extracted as "business_field"

Re: Time and Duration Dashboard

ITWhisperer — Wed, 28 Oct 2020 10:21:31 GMT

So looking at your sample data, business_field would be extracted as "(SaveCurrentDayRecordToDs) ", including the trailing space. This doesn't sound very unique. How do you distinguish one instance of this process running from another instance?

Re: Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 10:25:51 GMT

for completed in search i add "completed" and for processing i use "processing" in search and so on.. if you look at the queries its business_field + "status" that's what makes it unique

Re: Time and Duration Dashboard

ITWhisperer — Wed, 28 Oct 2020 10:37:27 GMT

If they were unique, your chart would have a single count of 1. What I am trying to get to is how you can detect the start of the process instance running and the end of that instance. For example, if your log looks like this

09:00 (SaveCurrentDayRecordToDs) status:READY_TO_PROCESS 09:01 (SaveCurrentDayRecordToDs) status:PROCESSING 09:02 (SaveCurrentDayRecordToDs) status:COMPLETED 10:00 (SaveCurrentDayRecordToDs) status:READY_TO_PROCESS 10:02 (SaveCurrentDayRecordToDs) status:PROCESSING 10:03 (SaveCurrentDayRecordToDs) status:READY_TO_PROCESS 10:05 (SaveCurrentDayRecordToDs) status:COMPLETED 10:06 (SaveCurrentDayRecordToDs) status:PROCESSING 10:10 (SaveCurrentDayRecordToDs) status:COMPLETED

What would you expect the duration of (SaveCurrentDayRecordToDs) to be? How many durations would you want reported?

How do you distinguish each run of SaveCurrentDayRecordToDs from the other from the data in your logs or do you just assume that COMPLETED applies to the previous READY_TO_PROCESS?

Re: Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 11:01:07 GMT

Business_field is a value I extracted from the data and it holds different processes within, this is what i used to extract it rex field=_raw "name\=\w+\s+(?<business_field>.*)\{" so different processes will have their own "Ready To Process" or "Completed" and i would be able to see it

Re: Time and Duration Dashboard

ITWhisperer — Wed, 28 Oct 2020 11:08:33 GMT

OK How many SaveCurrentDayRecordToDs READY_TO_PROCESS do you get in your first query?

Re: Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 11:34:35 GMT

depends on the time range i select

Re: Time and Duration Dashboard

ITWhisperer — Wed, 28 Oct 2020 11:47:39 GMT

Can you give an example?

Re: Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 15:01:42 GMT

Re: Time and Duration Dashboard

ITWhisperer — Wed, 28 Oct 2020 15:26:13 GMT

| stats earliest(_time) as start latest(_time) as end by business_field | eval timetaken=end-start

Re: Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 18:37:48 GMT

To which query do i add it to? "PROCESSING" of "COMPLETE"

Re: Time and Duration Dashboard

sphiwee — Wed, 28 Oct 2020 18:47:47 GMT

Why is the time like this? and where is the start time taken from and the end time?

Re: Time and Duration Dashboard

ITWhisperer — Wed, 28 Oct 2020 18:55:33 GMT

The time taken is in seconds. If you want it as a duration in minutes and seconds, you could try

| fieldformat timetaken=tostring(timetaken,"duration")

If you want to see the start and end times you could do this

| fieldformat start=strftime(start,"%Y-%m-%d %H:%M:%S") | fieldformat end=strftime(end,"%Y-%m-%d %H:%M:%S")