I am trying to get the count of events where the transaction duration is above the average duration and below the average duration.
below is my search to find out the count of events above the average transaction duration:
index=whatever* sourcetype="Source" "COMPONENTNAME=X" AND "EVENT=Received"|eval receivedtime=SERVER_TIME |join type=inner ORDERNUMBER max=0[search index=tas_prod sourcetype="TAS:FUSION:ProdSupport:PRD:AuditDB" "COMPONENTNAME=Y" AND "EVENT=Delivered"|eval deliveredTime=SERVER_TIME ]|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff>Avg| stats count as Grt
is it possible to get the count of transactions with diff < Avg in the same search? like:
searchStatement|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff>Avg| stats count as Grt | where diff < Avg |stats count as Lsr
please let me know if i can combine the count without using the same search statement another time to find the count for less than average
You could try this
.... | stats count(eval(diff>Avg)) as Grt count(eval(diff<Avg)) as Lsr
View solution in original post
thanks this worked.