Hello,
I have below search query
index=my_index openshift_cluster="cluster009" sourcetype=openshift_logs openshift_namespace=my_ns
("POST /online-shopping/debt_cart/v1 HTTP"
OR "GET /online-shopping/debt_cart/v1/* HTTP"
OR "GET *online-shopping*debt_cart*productType* HTTP")
| eval Operations=case(
searchmatch("POST /online-shopping/debt_cart/v1 HTTP"),"create_cart",
searchmatch("GET /online-shopping/debt_cart/v1/*/summary HTTP"),"cart_summary",
searchmatch("GET *online-shopping*debt_cart*productType* HTTP"),"cart_productType",
match(_raw, "GET /online-shopping/debt_cart/v1/[^/ ?]+\sHTTP"),"getDebtCart")
| stats avg(processDuration) as average perc90(processDuration) as response90 by Operations
| eval average=round(average,2),response90=round(response90,2)
which displays the data as below:
Operations | average | response90 |
create_cart | 250 | 380 |
cart_summary | 240 | 330 |
cart_productType | 210 | 321 |
getDebtCart | 260 | 365 |
Now I want to add the count of url pattern against each operation as below. I tried adding the count as part of stats. It is not working.
Not sure how do I proceed.
Operations | count | average | response90 |
create_cart | 1919 | 250 | 380 |
cart_summary | 2001 | 240 | 330 |
cart_productType | 1971 | 210 | 321 |
getDebtCart | 8162 | 260 |
365 |
Please share the SPL you tried (which isn't working) and explain what results you did get?
@ITWhisperer there was an issue in my search parameter of my SPL which I fixed. it is now returning count as expected. Apart from that no change in the stats part of the query
| stats count as hits avg(processDuration) as average perc90(processDuration) as response90 by Operations
Thank you once again
Please share the SPL you tried (which isn't working) and explain what results you did get?