Need your help,
Can you please help me to get the maximum totalresponsetime for the top 5 URL grouped by testtime? Currently I am getting 5 URL totalresponsetime grouped by testtime, but it's not giving the max value of totalresponsetime in the result,
| top totalresponsetime, url by testtime limit=5 | sort -totalresponsetime| stats list(url), list(totalresponsetime) by testtime
Another way is the search below which gives all URL and totalresponsetime,
index=idxperformancedata | eval totalresponsetime=(compFirstByte+compContent) | transaction testtime | stats list(url) list(totalresponsetime) by testtime
We want to sort by totalresponsetime desc and show only top 5 in a transaction.
Sample Data:
testtime,url,compFirstByte,compContent
1,url1,1,1
1,url2,2,2
1,url3,3,3
1,url4,4,4
1,url5,5,5
1,url6,6,6
2,url1,1,1
2,url2,2,2
2,url3,3,3
2,url4,4,4
2,url5,5,5
2,url6,6,6
2,url7,7,7
output:
testtime,url,totalresponsetime
1,url6,12
url5,10
url4,8
url3,6
url2,4
2,url7,14
url6,12
url5,10
url4,8
url3,6
Like this:
index=idxperformancedata | eval totalresponsetime=(compFirstByte+compContent) | sort 0 - totalresponsetime | streamstats global=f window=5 list(url) AS TOPurls list(totalresponsetime) AS TOPtotalresponsetimes by testtime | where mvcount(TOPurls)=5 | dedup testtime | table testtime TOPurls TOPtotalresponsetimes
I freely admit that there are surely far more efficient ways to do this but almost anything will be faster and more reliable than using transaction
.
Like this:
index=idxperformancedata | eval totalresponsetime=(compFirstByte+compContent) | sort 0 - totalresponsetime | streamstats global=f window=5 list(url) AS TOPurls list(totalresponsetime) AS TOPtotalresponsetimes by testtime | where mvcount(TOPurls)=5 | dedup testtime | table testtime TOPurls TOPtotalresponsetimes
I freely admit that there are surely far more efficient ways to do this but almost anything will be faster and more reliable than using transaction
.
Don't forget to click "Accept".
Try something like this
index=idxperformancedata [search index=idxperformancedata | | top url by testtime limit=5 | table url testtime ]| eval totalresponsetime=(compFirstByte+compContent) | transaction testtime | stats list(url) list(totalresponsetime) by testtime
Thanks somesoni2, i am trying to get high totalresponse time 5 url for each testtime. but this is not giving url and totalresponsetime as highest value ordering. also i have added sample data with output in the description.