- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
super_edition
Path Finder
05-16-2023
05:27 AM
Hello,
I have below search query
index=my_index openshift_cluster="cluster009" sourcetype=openshift_logs openshift_namespace=my_ns
("POST /online-shopping/debt_cart/v1 HTTP"
OR "GET /online-shopping/debt_cart/v1/* HTTP"
OR "GET *online-shopping*debt_cart*productType* HTTP")
| eval Operations=case(
searchmatch("POST /online-shopping/debt_cart/v1 HTTP"),"create_cart",
searchmatch("GET /online-shopping/debt_cart/v1/*/summary HTTP"),"cart_summary",
searchmatch("GET *online-shopping*debt_cart*productType* HTTP"),"cart_productType",
match(_raw, "GET /online-shopping/debt_cart/v1/[^/ ?]+\sHTTP"),"getDebtCart")
| stats avg(processDuration) as average perc90(processDuration) as response90 by Operations
| eval average=round(average,2),response90=round(response90,2)
which displays the data as below:
Operations | average | response90 |
create_cart | 250 | 380 |
cart_summary | 240 | 330 |
cart_productType | 210 | 321 |
getDebtCart | 260 | 365 |
Now I want to add the count of url pattern against each operation as below. I tried adding the count as part of stats. It is not working.
Not sure how do I proceed.
Operations | count | average | response90 |
create_cart | 1919 | 250 | 380 |
cart_summary | 2001 | 240 | 330 |
cart_productType | 1971 | 210 | 321 |
getDebtCart | 8162 | 260 |
365 |
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
05-16-2023
05:40 AM
Please share the SPL you tried (which isn't working) and explain what results you did get?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
super_edition
Path Finder
05-23-2023
12:16 AM
@ITWhisperer there was an issue in my search parameter of my SPL which I fixed. it is now returning count as expected. Apart from that no change in the stats part of the query
| stats count as hits avg(processDuration) as average perc90(processDuration) as response90 by Operations
Thank you once again
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
05-16-2023
05:40 AM
Please share the SPL you tried (which isn't working) and explain what results you did get?
