Hi All ,
I have this query :
index=no host=los* sourcetype= plp ( path=/desktop /pl/* ) OR ( path=/mobile/pl/* ) | stats perc95(responseTime) as "95th Perc Response Time" by path
I Want the result to come like this as shown below( coagulated response time for the desktop and mobile separately ) :
Path 95th Perc Response Time
/desktop/pl/* 234
/mobile/pl/* 2344
But the result is showing all the url's in path section just because i have used a wildcard in that place .
how to modify this query to get the expected the result. ??
Try this instead (NOT TESTED so there might be typos):
index=no host=los* sourcetype= plp (path="/desktop/pl/*" OR path="/mobile/pl/*")
| eval pathSummary = if(match(path, "/desktop/pl/*"), "/desktop/pl/*", "/mobile/pl/*")
| stats perc95(responseTime) as "95th Perc Response Time" by pathSummary
The second line groups your paths based on your preferences and then assigns that into a new field that you can use in your stats.
Thanks,
J
Since you have only two paths (or systems) i.e. desktop and mobile in your base search. Following should work:
index="no" host="los*" sourcetype="plp" ( path="/desktop/pl/*" ) OR ( path="/mobile/pl/*" )
| eval path=if(match(path,"desktop"),"desktop","mobile")
| stats perc95(responseTime) as "95th Perc Response Time" by path
Oh too late. You already got your answer 🙂
hahahha Thanks you Niket too....i guess logic is same in both . Thanks again 🙂
Try this instead (NOT TESTED so there might be typos):
index=no host=los* sourcetype= plp (path="/desktop/pl/*" OR path="/mobile/pl/*")
| eval pathSummary = if(match(path, "/desktop/pl/*"), "/desktop/pl/*", "/mobile/pl/*")
| stats perc95(responseTime) as "95th Perc Response Time" by pathSummary
The second line groups your paths based on your preferences and then assigns that into a new field that you can use in your stats.
Thanks,
J
Thanks a lot 🙂 ..it worked
@shabdadev, in order to avoid your code from getting escaped, use the code button (101010) while posting your query. Please try to Edit your question and re-post with code button query and sample table.
HI Niket i have modified the post ..please see again