Hello
I have a below query.
sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table RunID, Robot, host, duration
I need to count the sum(duration) by host and I want the result to be displayed day wise.
The result should be something like, Day1, host1, duration
Day1, host2, duration
Day2, host1, duration
Day2, host2, duration
How can I do that? Timechard sum(duration) span=1d works, but I need the duration to be calculated according to the host. How do I do that?
Thanks
Maria Arokiaraj
hey try this
sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table _time RunID, Robot, host, duration | bin _time span=1d | stats sum(duration) by _time host | sort- _time
let me know if this helps!
hey try this
sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table _time RunID, Robot, host, duration | bin _time span=1d | stats sum(duration) by _time host | sort- _time
let me know if this helps!
Hello @mayurr98
I tried this one already with bucket command and now with bin also as you have suggested.
For some reason, I am not getting any results out of these queries 😞
hey can you try this as | table _time RunID, Robot, host, duration
seems irrelavent. Also try below query for last 7 days or more. I tried in a test environment the query is working as long as you have enough data.Specify your_index
at start of the search
index=your_index sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | bin _time span=1d | stats sum(duration) by _time host | sort- _time
If above query does not work then try sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID
and see if you get any output. If you are getting output then the above query must work.
Thanks @mayurr98
It worked. Understood that the Table command in between caused the issue 🙂