Hi all,
Here is my base search
index=java location=APICall api_method=POST Duration |stats median(Duration) as median, perc70(Duration) as p70, perc90(Duration) as p90, perc95(Duration) as p95, perc99(Duration) as p99
How do I set an alert when 95th percentile is over let's say 30000ms ?
Thanks in advance
If I understand your data correctly you would want to add a where statement before the stats statement.
| where perc95(duration) > 30000
and if you want to add more clauses to the statement you can do it this way:
| where (perc70(duration) > 30000) OR (perc90(duration) > 30000) OR (perc95(duration) > 30000) OR (perc99(duration) > 30000)
This statement will remove any information that does not meet the said criteria.
index=java location=APICall api_method=POST Duration |timechart span=5m perc95(Duration) as P95| where P95> 30000ms
got it
timechart span=5m perc95(Duration) as P95 | where P95>30000ms
If I understand your data correctly you would want to add a where statement before the stats statement.
| where perc95(duration) > 30000
and if you want to add more clauses to the statement you can do it this way:
| where (perc70(duration) > 30000) OR (perc90(duration) > 30000) OR (perc95(duration) > 30000) OR (perc99(duration) > 30000)
This statement will remove any information that does not meet the said criteria.