Hi,
I have written a query to find average of the runtime for each job on daily basis. My query works fine and I get results as expected. However, the _time in the search events doesn't show the exact time of event.
e.g _time is step_dtm_pst = 2017-06-05 23:49:24
However, after I run the query _times shows: 05/06/2017 00:00:00.000
The reason for this is using bin _time span=1d
in query.
source="Temp10.csv" sourcetype="csv"
| where step_info ="WORKFLOW START" OR step_info = "WORKFLOW END"
| eval WfStart=If(step_info="WORKFLOW START",_time,null())
| eval WfEnd=If(step_info="WORKFLOW END",_time,null())
| sort 0 workflow_run_id
| streamstats latest(WfStart) as WfStart, earliest(WfEnd) as WfEnd by workflow_run_id
| eval WfDuration=round(((WfEnd-WfStart)/60),2)
| bin _time span=1d
| timechart eval(round(avg(WfDuration),2)) as avgWFDuration by workflow_name limit=0 useother=false
I am not sure how to resolve this. Please help.
Thanks,
Sneha
try this
source="Temp10.csv" sourcetype="csv"
| where step_info ="WORKFLOW START" OR step_info = "WORKFLOW END"
| eval WfStart=If(step_info="WORKFLOW START",_time,null())
| eval WfEnd=If(step_info="WORKFLOW END",_time,null())
| sort 0 workflow_run_id
| streamstats latest(WfStart) as WfStart, earliest(WfEnd) as WfEnd by workflow_run_id
| eval WfDuration=round(((WfEnd-WfStart)/60),2)
| timechart span=1d eval(round(avg(WfDuration),2)) as avgWFDuration by workflow_name limit=0 useother=false
try this
source="Temp10.csv" sourcetype="csv"
| where step_info ="WORKFLOW START" OR step_info = "WORKFLOW END"
| eval WfStart=If(step_info="WORKFLOW START",_time,null())
| eval WfEnd=If(step_info="WORKFLOW END",_time,null())
| sort 0 workflow_run_id
| streamstats latest(WfStart) as WfStart, earliest(WfEnd) as WfEnd by workflow_run_id
| eval WfDuration=round(((WfEnd-WfStart)/60),2)
| timechart span=1d eval(round(avg(WfDuration),2)) as avgWFDuration by workflow_name limit=0 useother=false
This works.
Thank you:)