I have a timechart that traffic volume over time and the top 15% of API performance times. I would like to add URI_Stem to the timechart so that I can track performance over time for each of my API calls. Not sure how that can be done.
| timechart span=1h count(_raw) as "Traffic Volume", perc85(time_taken) as "85% Longest Time Taken"
Example of table by URI_Stem
| stats count avg(time_taken) as Average BY cs_uri_stem | eval Average = round(Average, 2)
| table cs_uri_stem count Average
| sort -Average
| rename Average as "Average Response Time in ms"
I think I got it.
| timechart span=1h perc85(time_taken) by cs_uri_stem
OK. One search creates a timechart, another calculates overall averages by some parameter. How would you want to add "fixed" statistics to timechart?
Sorry, I wasn't clear. I only need to add the URI_Stem (which is the URL of the API from IIS) to the timechart shown in the first query. I want to track time_taken (performance of the calls to different APIs our app is making) over time so I can see outlier periods. Hopefully this is clearer.