I am trying to get average response times of all services (services1.. service n). I am able to get average response time by using the following search.
index = app1 "service1"|timechart avg(processTime)
Here is my log format.
0000037f SystemOut O {"serviceName":"service 1"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}
0000037f SystemOut O {"serviceName":"service 6"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}
How can i get the average response times for all the services (service1..service n).., without mentioning the service name in the search string?
Try this
.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm
OR
.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm
Try this
.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm
OR
.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm
Perhaps index = app1 "service*"|timechart avg(processTime)
?
This doesn't display the service name. I would like to have the service name and avg response times together.