Find response time by transaction ids

[kgandhi91]

I am trying to get response time for each of my services. However I end up using a wrong method to do this. 

track=prod app=servicename| stats by TrackingId

 How do i get just the avg response time based on TrackingId if say 2 events have the same TrackingId ?

2020-10-22 13:38:40.912 callerId=IndexConsumer, TrackingId=0db9610bb68a4097bee41ae95421936b app=servicename responseCode=500;elapsed=4968;responseLen=170]

2020-10-22 13:38:40.909 callerId=IndexConsumer, TrackingId=0db9610bb68a4097bee41ae95421936b app=servicename loggerclass=org.hibernate.engine.jdbc.spi.SqlExceptionHelper loggerline=142 loggermethod=logExceptions() loggerlevel=ERROR  

I want to use the singe number displayed chart to display this avg time duration. How do i do this ?

[ITWhisperer]

track=prod app=servicename
| stats earliest(_time) as start latest(_time) as end by TrackingId
| eval response=end-start
| stats avg(response)

This assumes that you are not just after the elapsed value from the log entry shown. Also, the problem with this method is that TrackingIds may span your time boundaries i.e. there could be entries before the time period starts for TrackingIds in the time period, and similarly entries after the time period ends which don't get included in the calculation giving lower response times.

If you just need the elapsed time from the log entry, assuming it isn't already extracted, you could use

| rex "elapsed=(?<elapsed>\d+)"
| stats avg(elapsed)

[richgalloway]

Have you tried this?

track=prod app=servicename
| stats avg(responseLen) as "avg response time" by TrackingId

Once you have the right result, click on the Visualization tab and choose the SingleValue viz.