product of static functions in timechart

[mak_sym]

Hi!

I need to calculate cost of rest calls in my application, and group it by service.
In other words I need to build F(_time, count_of_calls * avg_call_time) by service, something like this:

source="_mySource" "[PERFEVENT]" AND("T=SERVICE_CALL")  | rex field=_raw "URL=/(?<service>\w+)/.*\|EXEC" | rex field=_raw "EXEC=(?<exec_time>.+)\|CNT" | timechart usenull=f useother=f limit=0 span=10m avg(exec_time)*count() by service

Of course

avg(exec_time)*count()

does not work, but that is exactly what I need. I tried different approaches but nothing works. Has anybody solved the similar problem? Or it in not possible to build query like this?

[kristian_kolb · Accepted solution]

Why not calculate the actual total execution time?

...| timechart limit=0 useother=f usenull=f span=10m avg(exec_time) sum(exec_time) by service

/K

[mak_sym]

yes, it makes sense, thank you.