This is nice idea. I have come up with this query for 2 different time frames. Its retrieving/calculating the data for shorter timeframes (Ex: up to 3hours range). But for longer time frame, getting ...
See more...
This is nice idea. I have come up with this query for 2 different time frames. Its retrieving/calculating the data for shorter timeframes (Ex: up to 3hours range). But for longer time frame, getting partial data for the fields 'p90Avg_PageRenderingTime' or 'p90Avg_PageRenderingTime1'. PFA image. index="dynatrace" sourcetype="dynatrace:usersession" earliest=-50h@h latest=-46h@h | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="*****" | spath output=pp_user_action_name input=user_actions path=name | where pp_user_action_name in ("") | eval pp_user_action_name=substr(pp_user_action_name,0,60) | spath output=pp_user_action_response_VCT input=user_actions path=visuallyCompleteTime | stats count(pp_user_action_response_VCT) As "Count",avg(pp_user_action_response_VCT) AS "Avg_PageRenderingTime" by pp_user_action_name | join type=left [search index="dynatrace" sourcetype="dynatrace:usersession" earliest=-50h@h latest=-46h@h | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="*****" | spath output=pp_user_action_name input=user_actions path=name | where pp_user_action_name in ("") | eval pp_user_action_name=substr(pp_user_action_name,0,60) | spath output=pp_user_action_response_VCT input=user_actions path=visuallyCompleteTime | eventstats p90(pp_user_action_response_VCT) AS "p90_PageRenderingTime" by pp_user_action_name | where pp_user_action_response_VCT<=p90_PageRenderingTime | stats count(pp_user_action_response_VCT) As "Count1",avg(pp_user_action_response_VCT) AS "p90Avg_PageRenderingTime" values(p90_PageRenderingTime) by pp_user_action_name ] | join type=left [search index="dynatrace" sourcetype="dynatrace:usersession" earliest=-74h@h latest=-70h@h | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="*****" | spath output=pp_user_action_name input=user_actions path=name | where pp_user_action_name in ("") | eval pp_user_action_name=substr(pp_user_action_name,0,60) | spath output=pp_user_action_response_VCT input=user_actions path=visuallyCompleteTime | stats count(pp_user_action_response_VCT) As "Count2",avg(pp_user_action_response_VCT) AS "Avg_PageRenderingTime1" by pp_user_action_name ] | join type=left [search index="dynatrace" sourcetype="dynatrace:usersession" earliest=-74h@h latest=-70h@h | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="*****" | spath output=pp_user_action_name input=user_actions path=name | where pp_user_action_name in ("") | eval pp_user_action_name=substr(pp_user_action_name,0,60) | spath output=pp_user_action_response_VCT input=user_actions path=visuallyCompleteTime | eventstats p90(pp_user_action_response_VCT) AS "p90_PageRenderingTime1" by pp_user_action_name | where pp_user_action_response_VCT<=p90_PageRenderingTime1 | stats count(pp_user_action_response_VCT) As "Count3",avg(pp_user_action_response_VCT) AS "p90Avg_PageRenderingTime1" values(p90_PageRenderingTime1) by pp_user_action_name ] | eval Avg_PageRenderingTime=round(Avg_PageRenderingTime,0)/1000 | eval p90Avg_PageRenderingTime=round(p90Avg_PageRenderingTime,0)/1000 | eval Avg_PageRenderingTime1=round(Avg_PageRenderingTime1,0)/1000 | eval p90Avg_PageRenderingTime1=round(p90Avg_PageRenderingTime1,0)/1000 | table pp_user_action_name, Count,Avg_PageRenderingTime,p90Avg_PageRenderingTime,Count2,Avg_PageRenderingTime1,p90Avg_PageRenderingTime1 Any suggestions? thanks in advance.