How to summary index the start & end time when a request is slow performing

[sangs8788]

Hi,

I have a threshold defined for each request on what is normal it will take to process every 5mins. Below query checks and results the Requests which went beyond the normal threshold (defined in a lookup file) for every 5 mins. This logs an entry for every 5 mins.

earliest=-1h index=requestinfo  Request=*
| bin _time span=5m 
|stats P95(Response) AS "Response" by Request, _time
| lookup RequestThreshold.csv  Request OUTPUT NormalResponse
|eval Behaviour=case(Response > NormalResponse, "Abnormal", 1=1,"Normal") 
| search Behaviour="Abnormal"

My requirement is to run for past 1 month and also for future on a daily basis to get the continuous duration for which the Request was performing badly 95% of the time for every hour in a day, saying like 11 AM to 12 AM the R was beyond threshold. Again one more entry in saying same day 5:00 PM to 6:00PM it went beyond threshold. How do i achieve this ? Result something like below

START_TIME | END_TIME | R | Duration(s) | P95Response | Normal
10-04-2019 11:30 |10-04-2019 12:30 | Request1 | 3600| 35050 | 3000
10-04-2019 11:30 |10-04-2019 12:30 | Request2 |1800 | 590 | 300
10-04-2019 13:30 |10-04-2019 14:30 | Request1 |3600 | 89050 | 3000

Note that the Normal Threshold which is defined is for only 5mins range. So I am really confused on how to achieve this. Is this even possible?

[somesoni2]

YOu want to calculate instance (of an hour) where 95% of the time in that hour Behaviour was Abnormal??
What about instances which span over two hour numbers (like first one in your example output)?