Hi Team,
I am currently using below query:
index="abc"
sourcetype =$Regions$
source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log"
| rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process"
| timechart avg(duration) as duration span=1d
|eval duration=floor(duration/60)
| sort _time
I am able to see last 7days data individually
I want one panel where I can check for average for last 7 days like average of all that 7 days time.
Can someone guide.
Currently with my query I am able to see day wise I want average of it
Either I should select 1 week or 30 days or 60 days.
My current query
index="600000304_d_gridgain_idx*" sourcetype =$Regions$ source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" | rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process" | timechart avg(duration) as duration span=1d|eval duration=floor(duration/60)| sort _time
Not sure if I understand the request.
| timechart span=1month avg(duration) as duration
Or average for week over month.
| timechart span=1d avg(duration) as duration
| timewrap 1w
As of now it's by default 7 days but on date/ filter we can select anything
On that what should be out query
Not clear at all. You can make a dashboard where you can dynamically select timespan.
What about:
| timechart span=1w avg(duration) as duration
It's not only about week if I should select last 30 days it should show the average
Then you make a dashbord with time picker to select 1day, 1 week or 1 month.