I have data in the following structure received for every event. Some events have just one or two sub calls and some have more sub calls. I need to calculate the sum of the total duration.
subCalls: [ [-]
{ [-]
completionTimeMs: 69
method: GET
statusCode: 200
}
{ [-]
completionTimeMs: 77
method: GET
statusCode: 200
}
{ [-]
completionTimeMs: 956
method: POST
statusCode: 200
}
{ [-]
completionTimeMs: 201
method: PATCH
statusCode: 204
}
]
The below search calculates the sum of all the values in all the events instead of every event. Please suggest on how to proceed further.
mysearch
| eventstats sum(processRelevantFields.eventDetails.subCalls{}.completionTimeMs) as totalDuration
| table traceId, totalDuration