Show pie chart based on two search queries (append)

[mhornste]

Hi,

I have execution times in my index. I want to show statistics of long running queries (e.g. longer than 10 seconds). I'd like to display it in a pie chart.

The following query provides the correct counts, however, the pie chart is not working.

index=rc sourcetype=OtcsRemoteCache Operation=1001 Time_ms >= 10000|  stats count
    |  rename count as "Long Running Requests"
    |  append [search index=rc sourcetype=OtcsRemoteCache Operation=1001 Time_ms <10000|  stats count
    |  rename count as "Normal Requests"]

I know that I have to use "Stats count by comparison_category" but I can't make it work.

Any suggestions please?

[cmerriman]

can you try something like this:

index=rc sourcetype=OtcsRemoteCache Operation=1001|eval execTime=if(Time_ms>=10000,"Long Running Requests","Normal Requests")|stats count by execTime

[niketn]

You should be able to do this with single query:

index=rc sourcetype=OtcsRemoteCache Operation=1001 Time_ms=*
| eval RequestType=if(Time_ms>=10000,"Long Running Requests","Normal Requests")
| stats count by RequestType