I've JSON Object in msg field as :
"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}
I want to find out Average Total time taken by Successful responses i.e. in above example second attempts response time should be considered as it's success and not first attempts response time.
Total time taken = response time - requestTime;
so how to find out :
1. Average Response of All successful events found
2. Table with count for response time less than 1sec, between 1 sec to 2 sec, between 2sec to 3 sec, greater than 3 sec
Can you please help with Query ?
Thank you so much for your help and efforts.
Sample Data :
"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}
"objectB":{
"aggrStatus":"FAILURE",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
}
]
}
"objectC":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}
"objectD":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
]
}
Let's assume Object A to D are results of search. and in my case, Only Object A and C should be considered for calculation as they are success and object B and D are failure.
| rex "(?s)\"object\w\":(?<object>.*)"
| spath input=object path=attempts{} output=attempts
| mvexpand attempts
| spath input=attempts path=responses{} output=responses
| spath input=responses
| where status="SUCCESS"
| eval response=floor((responseTime-requestTime)/1000)
| stats count by response