i have table like this
id info starttime endtime responsetime source
2 inbound time1 time2 1sec raja
outbound
3 inbound time3 time4 3 sec raja1
outbound
i need to find out the timechart; like in 1 hr, how many id's were processed in 24 hrs
i am trying to do timechart span=1h count(id) by source
but I am getting error, could someone please help me?
thanks.
Try this (check the rex command as it was truncated in your comments)
index=**** source="****" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" AND
"Outbound Message" OR "Inbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" OR
"provZipCode assigned to zipCode" OR "Begin getProcedureDetailBluChip"|rex "(?Inbound|Outbound)" | rex "ID:(?.*)"
|rex "(?m)\(?.*)"|rex "(?m)\(?.*)" | timechart span=1h dc(id) by source
Try this (check the rex command as it was truncated in your comments)
index=**** source="****" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" AND
"Outbound Message" OR "Inbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" OR
"provZipCode assigned to zipCode" OR "Begin getProcedureDetailBluChip"|rex "(?Inbound|Outbound)" | rex "ID:(?.*)"
|rex "(?m)\(?.*)"|rex "(?m)\(?.*)" | timechart span=1h dc(id) by source
The timechart command requires field _time to be present in the resultset. Which field can be used to calculate _time?
index=**** source="****" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" AND
"Outbound Message" OR "Inbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" OR
"provZipCode assigned to zipCode" OR "Begin getProcedureDetailBluChip"|rex "(?Inbound|Outbound)" | rex "ID:(?.*)"
|rex "(?m)\(?.*)"|rex "(?m)\(?.*)"
|stats max(_time) as startTime,min(_time) as endTime,values(info) as Info,values(ResponseTime) as responseTime,values(StatusCode) as StatusCode,values(message) as StatusMessage by id,source
|eval responseTime=startTime-endTime |eval StartTime=strftime(startTime,"%Y-%m-%d %H:%M:%S,%3N")|eval EndTime=strftime(endTime,"%Y-%m-%d %H:%M:%S,%3N")
|table id,Info,StartTime,EndTime,responseTime,StatusCode,StatusMessage,source
my query like this i am trying to put the _time field in it , could you please suggest me..thanks...