Below is a query which returns the latency over month by cust_id. Events contain fields as month=April, month=May etc
...| chart max(Avg) as Avg, max(Max) as Max, p95(P95) as P95 over month by cust_id useother=f limit=40 |sort -Max, -P95
I would like to display this as a trellis chart by the Aggregation method used. While using Trellis Layout , i am getting graph each one for Max, Avg, P95 - 3 charts. How to display top 20 cust_id latency values for each aggregation method ? Is that possible ?
@sangs8788 try using the
split-by field as
cust_id instead of default
@niketnilay That would result me in layout for each customer. I would like to have the aggregation as the layout and display top 10 customer values for each aggregation type. How do i do that ?
@niketnilay Sorry if i am not being clear. What i would like to know is in a year, do we server customer with same Max, P95 ,Avg latency. To see which are the customer not satisfied for the entire year monthwise. This results may contain a customer whose value was high only for one month but not always/ or it is always. Is this possible ?
For this i would need a chart for Avg, Max, P95 - trend for every month and show only the top 20 values for each layout. Having split by month will not show me the trend of Avg/Max/p95 of the same customer/all customer.
@sangs8788, sorry I am not clear with the expected output. Can you draw something on paper/mock screenshot of expected output?
PS: I have converted my answer to comment so that the question flags as unanswered for others to pitch in as well 🙂