topic Re: How to split the call based on TimeTaken in Splunk Search

How to split the call based on TimeTaken

marinewcreater — Tue, 26 Oct 2021 23:01:36 GMT

I would like to create a Pie chart to show how many calls took less than 100ms, 200ms, and 300ms.

index=star env=prod |search time > 100 | stats count by time

How can I append > 200 and >300 in the same query?

Re: How to split the call based on TimeTaken

nmohammed — Tue, 26 Oct 2021 23:47:18 GMT

index=star env=prod | chart count(eval(time <100)) AS "<100ms", count(eval(time >100 AND time <200)) AS "<200ms", count(eval(time >200 AND time <300)) AS "<300ms" | stats count by time

try that query and select pie chart under visualizations.

Re: How to split the call based on TimeTaken

venkatasri — Tue, 26 Oct 2021 23:57:01 GMT

@marinewcreater

You could try stats with eval something like this , grouping them by time does not create a great pie chart you could still try it depends on number of data points, use | bin to bucket them before using by time.

index=star env=prod | searchTime > 100 | stats count(eval(searchTime>100)) as gt_100, count(eval(searchTime>200 AND searchTime<300)) as gt_200, count(eval(searchTime>300)) as gt_300

Re: How to split the call based on TimeTaken

marinewcreater — Wed, 27 Oct 2021 02:46:49 GMT

Error in stats command: eval is invalid

Re: How to split the call based on TimeTaken

acharlieh — Wed, 27 Oct 2021 05:21:45 GMT

In addition to the `count(eval())` options with stats as have already been suggested, another option would be to create a field that classifies your events by the durations you're interested in... then stats count by that new field...

If you have the specific ranges that you're interested in...you could use eval to construct a classifier, and then stats count by that classifier.

<base search> 
| eval classifier=case(time<100, "<100", time<200, "<200", time<300, "<300", true(), ">=300" )
| stats count by classifier

Since you have a numeric field, you could use bin to make those classifiers instead:

<base search> 
| bin time as classifier span=100 
| stats count by classifier

And of course there are many other methods of creating a classifier field (single or multi-valued), but the downside to doing a simple by clause is of course is that if you don't have a particular expected range/classifier in your data, you simply won't have that particular range in your output, which depending on your use case may be alright, or may be a problem.