How to use where condition to set threshold for avg response time

[vinayakkoli]

Hi Team, I am trying to get list of apis , whose avg response time is greater than particular threshold. Using Chart and timechart to gain avg response stats in dashboard to display APIs whose avg response time is greater than particular threshold. Query using: chart command:

index=### sourcetype=### | rex field=_raw "###(?[^ ]+)" | eval fields=split(Application_Name,"-") | eval Service_name=mvindex(fields,1)."-".mvindex(fields,2) |chart span=15m avg(response_time)  over _time by Service_name where avg > 5 usenull=f | fields - OTHER

and timechart command:

index=### sourcetype=### | rex field=_raw "###(?[^ ]+)" | eval fields=split(Application_Name,"-") | eval Service_name=mvindex(fields,1)."-".mvindex(fields,2) |timechart span=15m avg(response_time) by Service_name where avg > 5 usenull=f | fields - OTHER

.Results, for both using where condition, i could still see those api ,whose avg time is less than 5sec , but near to 5sec, e.g. api with 3 sec or 3.5 comes up panel.

[richgalloway]

Try this variation of the timechart search.

index=### sourcetype=### 
| rex field=_raw "###(?[^ ]+)" 
| eval fields=split(Application_Name,"-") 
| eval Service_name=mvindex(fields,1)."-".mvindex(fields,2) 
| timechart span=15m useother=f usenull=f avg(response_time) as avg by Service_name
| where avg > 5

[vinayakkoli]

Hi @richgalloway , thank you for reply.

After trying below, with time chart now its returning zero events, but in actual events exists.

[richgalloway]

Let's debug the query.  Run this search.  Do you get results?  Is the Service_name field populated properly?

index=### sourcetype=### 
| rex field=_raw "###(?[^ ]+)" 
| eval fields=split(Application_Name,"-") 
| eval Service_name=mvindex(fields,1)."-".mvindex(fields,2) 

Run this search next.  Do you get results?  Is the avg field populated properly?  Is the value of the avg field greater than 5 for any row?

index=### sourcetype=### 
| rex field=_raw "###(?[^ ]+)" 
| eval fields=split(Application_Name,"-") 
| eval Service_name=mvindex(fields,1)."-".mvindex(fields,2) 
| timechart span=15m useother=f usenull=f avg(response_time) as avg by Service_name

[vinayakkoli]

Hi @richgalloway 

Yes, this returning the results correctly, with expected service name and avg response time greater than 5secs.