Hi , We have a audit log with the information of different event types and their execution time for different customer IDs.
Something like we have checkoutEvent at the code and then it calls multiple downstream applications to validateCard , makePayments,applyPromotion etc. So execution time of checkoutEvent is time taken by our code and also time taken by downstream applications.
I am trying to create a pie chart which will show the time taken our code and downstream application response time. In order to do that i need to get the total time taken by the checkout event minus time taken by downstream application code.
Using below query i am able to get the time taken by each events
index=app_name | spath "EventStreamData.eventName" | search "EventStreamData.eventName"=CheckOutServiceEvent OR "EventStreamData.eventName"=ApplyPromotionEvent OR "EventStreamData.eventName"=ValidateCardEvent OR "EventStreamData.eventName"=CheckoutServiceEvent | timechart avg("EventStreamData.eventContext.executionTimeInMs") as "Avg Time" by "EventStreamData.eventName"
How do i include customerId in the above query and also i need to do find time taken by CheckOutServiceEvent and other down stream events . So that we can find which one is taking more time to respond in the dashboard.
