I am attempting to find half–hourly average of elapsed time for the GETXML message has exceeded 2,000ms for an half- hourly message count of 30,000 or more. I have the below query, BUT i am not sure how can add a check for this part "half- hourly message count of 30,000 or more" in the below query ?
can someone help
index=whatever* sourcetype=server GetXML timing=* | timechart span=30m avg(timing) by blob_type
Try this
index=whatever* sourcetype=server GetXML timing=* | bucket span=30m _time | stats avg(timing) as avgtiming count by blob_type, _time | where count>30000 | timechart span=30m avg(avgtiming) by blob_type
Try this
index=whatever* sourcetype=server GetXML timing=* | bucket span=30m _time | stats avg(timing) as avgtiming count by blob_type, _time | where count>30000 | timechart span=30m avg(avgtiming) by blob_type
Missed including the _time field. Check the updated answer
works now - thanks 🙂
doesnt seem to work 😞
This part doesnt seems to be working:
where count>30 | timechart span=30m avg(avgtiming) by blob_type