I have two events as below -
event 1
"id=1 api=xyz apiResTime=50"
event 2
"id=1 api=xyz duration=200"
I want to plot the difference between duration and apiResTime by api.
So far i have tried this
index="my_index"
| search * "apiResponseTime"="*" | table "api", "apiResponseTime" | rename "api" as api1 | rename "apiResponseTime" as x
| append [search * "duration"="*" | table "api", "duration" | rename "api" as api2 | rename "duration" as y ]
| eval api_match=if(match(api1, api2),1,0) //match the apis
| eval diff=if(api_match=1,y-x,y) // get the difference y-x on match
| table api1, api2, diff
But this is not giving me the required results. Any suggestions / pointers on how I can plot (timechart) the difference between (duration-apiResponseTime) by api. The above events can occur for multiple ids.
Firstly, don't use "index=something | search other_condition". Just use "index=something other condition".
First form returns all events from an index and then searches in them for the hits instead of searching for a subset in the first place. It's particularily significant with indexed fields.
But to the point - you can, for example, join two searches on common fields
<<search1>> | join id api [ <<search 2>> ]
As a result of this you should get events containing fields from both searches. So you can do your eval diff=Duration-apiResTime.
There are other options but this one seems most straightforward.