Table of results with transactions levels of durations

[niroren]

Hi,

how can we generate the below table statistics for transactions durations?

X=duration

Date, TotalNumberOfTrans, MaxDuration, X<1m, %<1m, X<1h, %<1h, X<6h, %<6h, X<24h, %<24h, X>24h, %>24h

Thanks,
Nir Oren

[niroren]

Great!
Thanks

[yannK]

If your intervals were constant you could use the eval command "range" to do so.
But as you have discrete ranges (1m, 1h, 6h, 24h, 24h+) you can create a grouping using an eval case command.

The example is a bit cumbersome, and does not contains the MaxDuration, once we do the chart grouping.

example :

<pseudo search to get your results >
| bucket _time span=1d
| eval duration_range=case(X<0,"invalid",X<60,"1minute",X<(60*60),"1hour",X<(60*60*24),"1day",1=1,"morethan1day")
 | stats count AS CountTransaction max(X) AS MaxDuration by _time duration_range
 | chart max(CountTransaction) AS CountTransaction max(TotalTransactions) AS TotalTransactions by _time duration_range

 | fillnull "CountTransaction: 1hour" "CountTransaction: 1minute" "CountTransaction: 1day" "CountTransaction: morethan1day" value="0" 
 | eval TotalTransactions='CountTransaction: 1hour'+'CountTransaction: 1minute'+'CountTransaction: 1day'+'CountTransaction: morethan1day'
 | eval "percent: 1minute"=round(100*'CountTransaction: 1minute'/TotalTransactions,2)."%"
 | eval "percent: 1hour"=round(100*'CountTransaction: 1hour'/TotalTransactions,2)."%"
 | eval "percent: 1day"=round(100*'CountTransaction: 1day'/TotalTransactions,2)."%"
 | eval "percent: morethan1day"=round(100*'CountTransaction: morethan1day'/TotalTransactions,2)."%"