For hourly maximum value graph of REST API request response , I want logs of maximum value on drill down

Digvijay — Wed, 14 Jul 2021 15:25:43 GMT

In the above attachment , I created graph which shows hourly maximum response time with respect to request response pair .Now in drilldown when I click on any slot maximum response time(marked in yellow) ,I want to show the logs of that request response pair(2 events will be there in result) only which has this maximum value.

Query used for graph :

index=salcus sourcetype= ticket_mgmt_rest source= http:ticket_mgmt_rest |rename "properties.o2-TroubleTicket-ReqId" as REQID | transaction REQID keepevicted=true | search eventcount=2 | timechart span=1h eval(round(max(duration),3)) as MaxRespTime count by sourcetype|fillnull

Re: For hourly maximum value graph of REST API request response , I want logs of maximum value on drill down

ITWhisperer — Wed, 14 Jul 2021 15:54:33 GMT

Use this search and a token for the time period clicked in the drilldown to select the relevant transaction

topic Re: For hourly maximum value graph of REST API request response , I want logs of maximum value on drill down in Splunk Search

For hourly maximum value graph of REST API request response , I want logs of maximum value on drill down

Re: For hourly maximum value graph of REST API request response , I want logs of maximum value on drill down