Hi,
I want to look at each response_time value for each Tier, and count the amount of response times that are above and below the MaxResponseTime that corresponds to each separate Tier. I have 5 Tiers (categories) with all different MaxResponseTime values.
Here's the search so far:
| datamodel metric summariesonly=true search
| search "metric.date"=2021-06-28
| rename "metric.date" as date
| rename "metric.Tier" as Tier
| rename "metric.response_time" as response_time
| stats values(response_time) by Tier | rename values(response_time) as response_time
@ebs can you try this?
| datamodel metric summariesonly=true search
| search "metric.date"=2021-06-28
| rename "metric.date" as date
| rename "metric.Tier" as Tier
| rename "metric.response_time" as response_time
| stats values(response_time) as resp_time, max(maxResponseTime) as max_resp by Tier
| mvexpand resp_time
| stats count(eval(resp_time > max_resp)) as gt, count(eval(resp_time < max_resp)) as lt, list(resp_time), count(resp_time) as total_resp_count by Tier
| eval below_perc=(lt/total_resp_count) * 100
---
An upvote would be appreciated and Accept solution if it helps!
@ebs can you explain with sample events i guess i did not quite get it.
Sure,
Tier 1 (MaxResponseTime): 1500
Tier 1 (response_time): 1483, 1682, 1000, 887, 1936
Tier 1 (Count Below): 3
Tier 1 (Count Above): 2
Tier 1 (Performance) 3/5
Tier 2 (MaxResponseTime): 3000
Tier 2 (response_time): 3278, 4529, 5763, 2800, 1600
Tier 2 (Count Below): 2
Tier 2 (Count Above): 3
Tier 2 (Performance): 2/5
@ebs can you try this?
| datamodel metric summariesonly=true search
| search "metric.date"=2021-06-28
| rename "metric.date" as date
| rename "metric.Tier" as Tier
| rename "metric.response_time" as response_time
| stats values(response_time) as resp_time, max(maxResponseTime) as max_resp by Tier
| mvexpand resp_time
| stats count(eval(resp_time > max_resp)) as gt, count(eval(resp_time < max_resp)) as lt, list(resp_time), count(resp_time) as total_resp_count by Tier
| eval below_perc=(lt/total_resp_count) * 100
---
An upvote would be appreciated and Accept solution if it helps!
Amazing, thanks so much!
Hi @ebs
Since you are already doing stats by Tier you will find values something like this single event.
response_time, Tier
4 Tier1
2
3
1
Your maxResponseTime = 4, there are no respTimes above max as 4 itself max for that Tier, below maxRespTime are always total count (4) - 1 = 3. Is that what you want to acheive?
--
An upvote would be appreciated if it helps!
So basically, say I have a MaxResponseTime of 1500 for Tier1. I want to count all the response_time's for Tier1 that are under 1500 and all the ones over Tier1. Tier2's MaxResponseTime is 3000, I would want to count all the ones for this both under and over the MaxResponseTime as well. I also then ant to do a percentage of the amount of response time's that fell under the threshold per tier.