How can I make my table results in 3s time intervals?

[moizmmz]

Query I am running:

index="dcg-video-eng-live-services-stage" | spath "message.req.originalUrl" | search "message.req.originalUrl"!="/health-check"| spath severity | search severity!=warn|search message.extraLogInfo./api2/asset/get.assets{}.desc!=null() 
|table _time message.extraLogInfo./api2/asset/get.assets{}.desc message.extraLogInfo./api2/asset/get.assets{}.duration
| rename  message.extraLogInfo./api2/asset/get.assets{}.desc as Channel, message.extraLogInfo./api2/asset/get.assets{}.duration as Duration
|sort -_time

This results in the following table:

https://drive.google.com/open?id=1PaUuxMNy29QYtjzKbc2i0ulGybXXSnL6 (also shown in image)

As shown in the image, the results have varying time intervals.
I want to get the results in the table to be in time intervals of 3s.

How do I go about doing it?

Thanks!

[sdchakraborty · Accepted solution]

Hi,

Can you try the below search,

index="dcg-video-eng-live-services-stage" | spath "message.req.originalUrl" | search "message.req.originalUrl"!="/health-check"| spath severity | search severity!=warn|search message.extraLogInfo./api2/asset/get.assets{}.desc!=null() 
 |table _time message.extraLogInfo./api2/asset/get.assets{}.desc message.extraLogInfo./api2/asset/get.assets{}.duration
 | rename  message.extraLogInfo./api2/asset/get.assets{}.desc as Channel, message.extraLogInfo./api2/asset/get.assets{}.duration as Duration
 |sort -_time
 |  mvexpand Channel
| mvexpand Duration
|  bin span=3s _time
|  stats values(Channel) as Channel, values(Duration) as Duration by _time

[moizmmz]

It is giving me the 3s interval. Thanks 🙂

But its also giving me other data I don't want. Sorta combining two mv values

[moizmmz]

But on explicitly eliminating that data using '!=', I got what I wanted 🙂

Thank you!!

[sdchakraborty]

Cool.please accept it as answer if it is resolved your issue.

[moizmmz]

Hey..I'm seeing a problem, the time stamp is repeating in some cases

[moizmmz]

Never mind, used dedup 😛

[nagarjuna280]

try adding at the end

| bin _time span=3s | stats values(channel), values(duaration)

[moizmmz]

Nope.
The results are mv and without a timestamp.