Hi, I am working on a query where I need to calculate the average of 99th percentile values over a 5 minute period of time for last 24 hours by serviceName. serviceName is nothing but the web service called by consumer and i am looking to have the response time of some services.
Below is my query -
index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName useother=false
which gives a table like this -
_time | service1 | service2 | service3 |
00:05 | 1.2 | 0.8 | 2.4 |
00:10 | 1.7 | 0.34 | 2.8 |
00:15 | 1.5 | 1.2 | 3.4 |
What i want is calculate the average of these and put it in another table. Something like this -
serviceName | responseTime |
service1 | 1.37 |
service2 | 0.4 |
service3 | 2.1 |
Hope someone can help.
Try
index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName useother=false
| untable _time,service,responseTime
| stats avg(responseTime) as responseTime by service
Try
index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName useother=false
| untable _time,service,responseTime
| stats avg(responseTime) as responseTime by service
Perfect It worked like charm. Thanks @renjith_nair