 
					
				
		
Hi,
I have execution times in my index. I want to show statistics of long running queries (e.g. longer than 10 seconds). I'd like to display it in a pie chart.
The following query provides the correct counts, however, the pie chart is not working.
index=rc sourcetype=OtcsRemoteCache Operation=1001 Time_ms >= 10000|  stats count
    |  rename count as "Long Running Requests"
    |  append [search index=rc sourcetype=OtcsRemoteCache Operation=1001 Time_ms <10000|  stats count
    |  rename count as "Normal Requests"]
I know that I have to use "Stats count by comparison_category" but I can't make it work.
Any suggestions please?
 
					
				
		
can you try something like this:
index=rc sourcetype=OtcsRemoteCache Operation=1001|eval execTime=if(Time_ms>=10000,"Long Running Requests","Normal Requests")|stats count by execTime
 
					
				
		
You should be able to do this with single query:
index=rc sourcetype=OtcsRemoteCache Operation=1001 Time_ms=*
| eval RequestType=if(Time_ms>=10000,"Long Running Requests","Normal Requests")
| stats count by RequestType
