How to create a table listing service request, Avg responsetime, subsystem, and Error Rate/hr in a specific format?

[jagadish85]

I have to create a dashboard in the below table format. Intention is to create a dashboard showing the number of requests per hour that each service is handling, its status, responsetime, and Errors grouped by Subsystem under which each service belongs.

My sample Log:

2015-08-19 16:01:51 SubsystemName=AAA; Service=S1;version=1;duration=100ms;RequestStatus=Success
2015-08-19 16:02:51 SubsystemName=AAA; Service=S1;version=1;duration=10ms;RequestStatus=Success
2015-08-19 16:01:51 SubsystemName=AAA; Service=S2;version=1;duration=60ms;RequestStatus=FAILURE
2015-08-19 16:01:51 SubsystemName=BBB; Service=S1;version=2;duration=120ms;RequestStatus=Success

Now clicking on any service, say S1 (of Subsystem AAA), should give a timechart of TotalRequests/Errors per period for that service under subsystem AAA

[somesoni2]

Try something like this

Your base search | bucket span=1h _time | eval duration=replace(duration,"(\d+)(\w+)","\1") | eval Fail=if(RequestStatus="FAILURE",1,0) |stats count as RequestPerHr avg(duration) as AvgResponse,sum(Fail) as ErrorCount by SubsystemName,ServiceName,ServiceVersion

For how much timerange this search is running?

[jensonthottian]

for per hour results use :

|bucket _time span=1h |stats count by _time

Add the average, min , max, requests to the query as you had done above.

[jagadish85]

|eval event=1|stats avg(duration) as AvgResponse,count(eval(RequestStatus="FAILURE")) as ErrorCount,sum(event) as Requests by SubsystemName,ServiceName,ServiceVersion is not giving me the exact table format I wanted (not merging Subsystem in to one row).

also how to get Requests/hour,Errors/hr as well.