I have a line chart in which I'm trying to monitor response time for a certain network call. I want to see the average response time, over time, by platform in a line chart.
Input data looks something like this:
|network call #||response time (ms)||platform|
and my current query looks like this:
| search mysearch
| spath response_time
| spath input=request_payload output=platform path=client_properties.platform
| streamstats avg(response_time) as platform_response_time by platform time_window=10m
| chart first(platform_response_time) over _time by platform
This is getting my pretty close, but theres something about it that isn't "right" :
What can I do to make the line's... better? I don't even know how to phrase this, but there shouldn't be 0 values. The lines shouldn't be jumping up and backdown to 0 at every tick. They should be more "straight". The problem, I think, is that I'm creating a point for each interval of time, and there isn't a request for every platform at every interval.
Is there a way to group time intervals together in a longer period of time? i.e. there will only be a plot point for the average repsonse time each 5 minute interval? If there are truly 0 requests in 5m from a platform, that should be reflected, but it isn't likely and wouldn't happen so often.