Hi,
I would like to get results only if response time is greater than median time. I have used below query. But for some reason it shows all the values. Also can you let me know if this is efficient way of doing it?
my search | eventstats p50(Time1) as Time | append [search my search| where Time1> Time | stats count by Server,Env,URI,Time1 ] | table Server,Env,URI,Time1
Hi xvxt006,
try something like this:
my search | stats p50(Time1) as pTime by Server, Env, URI, Time1 | where Time1 > pTime | table Server, Env, URI, Time1
hope that helps ...
cheers, MuS
Hi xvxt006,
try something like this:
my search | stats p50(Time1) as pTime by Server, Env, URI, Time1 | where Time1 > pTime | table Server, Env, URI, Time1
hope that helps ...
cheers, MuS
Hi Mus,
I had tried like that but it is not really calculating median time for all the data points as we have stats by server, Env, URI, Time1. Each data point shows its Time value as median value which i don't want.
okay, just tested something similar and it works ... try this:
my search | eventstats p50(Time1) as pTime | where Time1 > pTime | table Server, Env, URI, Time1
Thanks. I have tried this previously and for some reason it did not work. Now it worked. Thanks for your help.