I have two datetime fields that I would like to use to calculate average lagtime as each message coming contains these fields. I would like to display some sort of panel showing this in seconds.
pubDate:"2014-04-30 11:27:49" scrapeDate:"2014-04-30 11:27:53"
any help appreciated.
... | eval pubDate="2014-04-30 11:27:49" | eval scrapeDate="2014-04-30 11:27:53" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | table pubDate, scrapeDate, lagtime
Try this:
sourcetype="data.newIndex.stats" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | chart max(lagtime)
I tried the following:
search sourcetype="data.newIndex.stats" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | table pubDate, scrapeDate, lagtime
I used a dial gauge on my panel but get the following message:
These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit h
I would like the above query to only return the max result