get size/bytes of log events and the number events by direction (request/response)

[edookati]

I am trying to get the number of requests/response that we send/receive to/from one application and the combined size of request & responses per hour.

I am using the below query, but this doesn't seem to work.

index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eventstats sum(raw_len), count by date_hour, Direction

I need results in the below table format...

date.hour NumberofRequests(direction=REQUEST) Number of Responses (direction=RESPONSE) Sum(bytes)

Can someone please help me with this?
Thanks.

[martin_mueller · Accepted solution]

Try this:

index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eval count_{Direction} = 1 | timechart sum(count_REQUEST) as NumberOfRequests sum(count_RESPONSE) as NumberOfResponses sum(raw_len) as CombinedSize

[edookati]

great! it worked. Thanks a lot.