topic Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage. in Splunk Search

query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

valameti — Wed, 03 Sep 2014 04:17:06 GMT

hi,
please help me in query to find the values of transactions between 3 to 5secs, 7 to 9 secs and above 9 secs in percentage.

Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

musskopf — Wed, 03 Sep 2014 05:08:18 GMT

Are you talking about transaction duration? Could pls post more details,data example, etc?

From what I can "guess" you might use rangemap command, like that:

| rangemap field=duration veryfast=0-3 fast=3-5 normal=5-9 default=slow | top range

But you also could use "eval" combined with "case" or "if", which can be more flexible.
| eval range=CASE(duration < 0, "veryfast", duration < 3, "normal", duration < 5, "slow")

Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

valameti — Wed, 03 Sep 2014 05:13:58 GMT

What I am looking for a simply chart for RCV for day need to break down by hour , % of transaction between 3 to 5 secs and 5 to 7 secs and 7 to 9 secs and above 9 secs..

Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

musskopf — Wed, 03 Sep 2014 05:17:56 GMT

Could pls post some example of the raw data?

Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

valameti — Wed, 03 Sep 2014 05:37:03 GMT

please find the raw data below
[2108749225][8/26/14 00:59:17:858 CDT][..][][INFO][com.xx.common.perfmon.PerformanceMonitor][WebContainer : 2] PERFMON: KEY: 2108749225 API: IO ET: 2516ms [NAME: Agg For RCV ET: 2474ms

Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

musskopf — Wed, 03 Sep 2014 05:41:38 GMT

if you already have the fields extracted, just use the "case" example I posted, adjusting it for the field and ranges you wish, like:
index=main | eval range=CASE(myField < 0, "veryfast", myField < 3, "normal", myField < 5, "slow") | top range. It'll show a table, or chart with the values and %.

Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

valameti — Wed, 03 Sep 2014 06:02:17 GMT

Thanks alot.it is working.:)

Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

valameti — Wed, 03 Sep 2014 07:28:19 GMT

when i use the above query it is displaying the chart in count .it is possible to display the chart in percent?
please help me.

Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

musskopf — Thu, 04 Sep 2014 21:28:44 GMT

The "top" command will return count and percentage. You can remove the count column by adding "| fields - count" at the end.

Re: query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

valameti — Mon, 08 Sep 2014 10:16:46 GMT

How can I get this data charted for a day, I mean to plot a graph of % of transactions (fast, normal,slow) for hours of the day.