count by response time range

[jibiuthaman]

source aaa| eval Description=case(rt_sec>10, "G10", rt_sec>20, "G20", rt_sec>30, "G30", rt_sec>40, "G40") | stats count by Description

this seems to only give me results for G10 even though I have many cases with response times greater then 10 sec... if i just do source aaa rt_sec > 20, I get results. Please help me find the issue here.

[somesoni2 · Accepted solution]

Try this.

source=aaa | eval Description=case(rt_sec>10 AND rt_sec<=20,"G10", rt_sec>20 AND rt_sec<=30,"G20",rt_sec>30 AND rt_sec<=40,"G40",rt_sec>40,"G10")| stats count by Description

[ksuyash]

I'm having similar query but when using the below case .. onlt <=500 and >=1500 are getting counted in stats 
duration =6000's are also getting counted in >1500ms case not sure why

index=*
| rex "TxDurationInMillis=(?<TxDurationInMillis>\d+)"
| eval ResponseTime = tonumber(TxDurationInMillis)
| eval ResponseTimeCase=case(
ResponseTime <= 500, "<=500ms",
ResponseTime > 500 AND ResponseTime <= 1000, ">500ms and <=1000ms",
ResponseTime > 1000 AND ResponseTime <= 1400, ">1000ms and <=1400ms",
ResponseTime > 1400 AND ResponseTime < 1500, ">1400ms and <1500ms",
ResponseTime >= 1500, ">=1500ms"
)
| table TxDurationInMillis ResponseTime ResponseTimeCase

[jibiuthaman]

Work and thanks again..