Given the following search logic
index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) | bin _time span=1d | stats count as Total, count(eval(DurationTotal>$ActionSLA$) AS Latent by _time Action | eval Percent=round(100-((Latent*100)/Total),2)
I want to have the $ActionSLA$ variable in the above pseudocode be different for each action so that I end up with results that look like the following where the Latent field is driven by the ActionSLA per Action. For instance Search ActionSLA=2000 when Action=Search, ActionSLA=4000 when Action=CreateOrder, etc.
_time Action Total Latent Percent 2017-01-26 09:00 Confirm 1259 864 31.37 2017-01-26 09:00 CreateOrder 611 147 75.94 2017-01-26 09:00 CreditRefund_Confirm 333 237 28.83 2017-01-26 09:00 FindItinerary 12461 2155 82.71 2017-01-26 09:00 Search 8349 3481 58.31
Considering there are only 5 Actions, you can use eval case command to specify/use the SLA for each action. Try this. Replace SLAfor* with appropriate values.
index=* (Action=Search OR Action=CreateOrder OR Action=FindItinerary OR Action=Confirm OR Action=CreditRefund_Confirm) | bin _time span=1d | eval Latent=case(Action="Search" AND DurationTotal>SLAforSearch,1,Action="CreateOrder" AND DurationTotal>SLAforCreateOrder,1, Action="FindItinerary" AND DurationTotal>SLAforFindItinerary,1,Action="Confirm" AND DurationTotal>SLAforConfirm,1, Action="CreditRefund_Confirm" AND DurationTotal>SLAforCreditRefund_Confirm,1, true(),0) | stats count as Total, sum(Latest) as Latent by _time Action | eval Percent=round(100-((Latent*100)/Total),2)
Ha, this is exactly what I was thinking of doing as well, but the syntax was throwing me. This did in fact work, thank you!