query to find the values 3 to 5 secs, 7 to 9 secs and above 9 secs in percentage.

[valameti]

hi,
please help me in query to find the values of transactions between 3 to 5secs, 7 to 9 secs and above 9 secs in percentage.

[valameti]

How can I get this data charted for a day, I mean to plot a graph of % of transactions (fast, normal,slow) for hours of the day.

[musskopf · Accepted solution]

Are you talking about transaction duration? Could pls post more details,data example, etc?

From what I can "guess" you might use rangemap command, like that:

| rangemap field=duration veryfast=0-3 fast=3-5 normal=5-9 default=slow | top range

But you also could use "eval" combined with "case" or "if", which can be more flexible.
| eval range=CASE(duration < 0, "veryfast", duration < 3, "normal", duration < 5, "slow")

[musskopf]

The "top" command will return count and percentage. You can remove the count column by adding "| fields - count" at the end.

[valameti]

when i use the above query it is displaying the chart in count .it is possible to display the chart in percent?
please help me.

[valameti]

Thanks alot.it is working.:)

[musskopf]

if you already have the fields extracted, just use the "case" example I posted, adjusting it for the field and ranges you wish, like:
index=main | eval range=CASE(myField < 0, "veryfast", myField < 3, "normal", myField < 5, "slow") | top range. It'll show a table, or chart with the values and %.

[valameti]

please find the raw data below
[2108749225][8/26/14 00:59:17:858 CDT][..][][INFO][com.xx.common.perfmon.PerformanceMonitor][WebContainer : 2] PERFMON: KEY: 2108749225 API: IO ET: 2516ms [NAME: Agg For RCV ET: 2474ms

[musskopf]

Could pls post some example of the raw data?

[valameti]

What I am looking for a simply chart for RCV for day need to break down by hour , % of transaction between 3 to 5 secs and 5 to 7 secs and 7 to 9 secs and above 9 secs..