Hi How many events base search is returning and how long it takes to finish? There are limits for those. Quite probably you have hit by those? When I look your base and post search you could modify...
See more...
Hi How many events base search is returning and how long it takes to finish? There are limits for those. Quite probably you have hit by those? When I look your base and post search you could modify your base search to include stats there which is the recommended way to use it. index=myindex TERM(keyword) fieldname1="EXIT"
| bin _time span=1d
| stats count as Total, count(eval(httpStatusCde!="200" OR statusCde!="0000")) as failures, exactperc95(respTime) as p95RespTime by _time EId Then both post searches something like this | search EId="5eb2aee9"
| stats count as Total, count(failures) as failures, first(p95RespTime) as p95RespTime by _time
| eval "FailureRate"= round((failures/Total)*100,2)
| table _time, Total, FailureRate, p95RespTime
| sort -_time r. Ismo