https://community.splunk.com/t5/Splunk-Search/How-to-append-tp99-and-tp90-in-the-existing-query/m-p/585227#M203873 <P>Hello Splunk community. I have a query that is running currently as shown below:</P> <P>&nbsp;</P> <LI-CODE lang="markup">index=myIndex* api.metaData.pid="my_plugin_id" | rename api.p as apiName | chart count BY apiName "api.metaData.status" | multikv forceheader=1 | table apiName success error NULL | eval line=printf("%-85s% 10s% 10s% 7s",apiName, success, error, NULL) | stats list(line) as line | eval headers=printf("%-85s% 10s% 10s% 7s","API Name","Success","Error", "NULL") | eval line=mvappend(headers,line) | fields - headers</LI-CODE> <P>&nbsp;</P> <DIV> <DIV><SPAN>Which displays a table with&nbsp;"API Name","Success","Error", "NULL" counts. This works as expected.<BR /><BR />Now i want to add a new column in the table which displays the latency value (tp95 and tp99) for each <STRONG>apiName </STRONG>. The time taken by each api is in the field api.metadata.tt.<BR /><BR />How can i achieve this ? I am new to splunk and I am literally stuck at this point. Could someone please help me. Thank you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /><BR /><STRONG>Info</STRONG>: Just to let you guys know, my query has these additional logic to format things because of related question <A href="https://community.splunk.com/t5/Splunk-Search/Combining-multiple-rows-of-chart-data-into-one-for-alerting/m-p/578356#M201557" target="_self">here</A></SPAN></DIV> </DIV> Thu, 17 Feb 2022 00:23:47 GMT VikhyathMaiya 2022-02-17T00:23:47Z https://community.splunk.com/t5/Splunk-Search/How-to-append-tp99-and-tp90-in-the-existing-query/m-p/585227#M203873 <P>Hello Splunk community. I have a query that is running currently as shown below:</P> <P>&nbsp;</P> <LI-CODE lang="markup">index=myIndex* api.metaData.pid="my_plugin_id" | rename api.p as apiName | chart count BY apiName "api.metaData.status" | multikv forceheader=1 | table apiName success error NULL | eval line=printf("%-85s% 10s% 10s% 7s",apiName, success, error, NULL) | stats list(line) as line | eval headers=printf("%-85s% 10s% 10s% 7s","API Name","Success","Error", "NULL") | eval line=mvappend(headers,line) | fields - headers</LI-CODE> <P>&nbsp;</P> <DIV> <DIV><SPAN>Which displays a table with&nbsp;"API Name","Success","Error", "NULL" counts. This works as expected.<BR /><BR />Now i want to add a new column in the table which displays the latency value (tp95 and tp99) for each <STRONG>apiName </STRONG>. The time taken by each api is in the field api.metadata.tt.<BR /><BR />How can i achieve this ? I am new to splunk and I am literally stuck at this point. Could someone please help me. Thank you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /><BR /><STRONG>Info</STRONG>: Just to let you guys know, my query has these additional logic to format things because of related question <A href="https://community.splunk.com/t5/Splunk-Search/Combining-multiple-rows-of-chart-data-into-one-for-alerting/m-p/578356#M201557" target="_self">here</A></SPAN></DIV> </DIV> Thu, 17 Feb 2022 00:23:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-tp99-and-tp90-in-the-existing-query/m-p/585227#M203873 VikhyathMaiya 2022-02-17T00:23:47Z