operationName | urls | avg_time | max_time | count |
MethodUsingGET | https://www.google.com/api/v1/571114808/CAR.202 https://www.google.com/api/v1/571114899 | 3255 | 3255 | 2 |
UsingGET | https://www.googleA.com/api/v1/571114888/api/ https://www.googleB.com/api/v1/571114877/api/ | 1316.889 | 5345 | 18 |
I would only want one url but it should count others as well. Is there a way?
What search did you use to get these results? What do your events look like?
index=*
| rex "(?i)\".*?\":(?P<operationId>\d+)(?=,)"
| rex "(?i)\".*?\":(?P<responseTime>\d+)(?=,)"
| rex "(?i)\".*?\":(?P<Url>\d+)(?=,)"
| stats values(Url) as urls, avg(responseTime) as avg_time, max(responseTime) as max_time, count by operationId
The results are in pretty in splunk but when i download the csv file all the results are in like 1 line and doesnt have data like it showed
Try something this
| stats avg(responseTime) as avg_time, max(responseTime) as max_time, count by operationId, Url
the results are like this
operationId | Url | avg_time | max_time | count |
accountUsingGET | https://*/api/account/history/sourceaccount | 1675.33333 | 4914 | 3 |
accountUsingGET | https://*/api/account/history/sourceaccount | 1324.7 | 5345 | 10 |
LineUsingPOST | https://*/api/lines/1012/activate | 1224 | 1224 | 1 |
LineUsingPOST | https://*/api/lines/1014/activate | 1015 | 1015 | 1 |
LineUsingPOST | https://*/api/lines/1017/activate | 1506 | 1015 | 1 |
but i only want one data from operationId and Url but it should count all and give avg response time as well, like this, is there a way?
operationId | Url | avg_time | max_time | count |
accountUsingGET | https://*/api/account/history/sourceaccount | 1675.33333 | 4914 | 13 |
LineUsingPOST | https://*/api/lines/1012/activate | 1224 | 1224 | 3 |
I don't think so - if you do stats by operationId, Url you will only get one row for each unique combination of these fields, which is what you said you wanted.