All,
I have an index with some fields like appId and responsetime. I also have a dataset where the appId is same, but in this file I have a propername linked with the appId
So as example INDEX O...
See more...
All,
I have an index with some fields like appId and responsetime. I also have a dataset where the appId is same, but in this file I have a propername linked with the appId
So as example INDEX OUTPUT appId, responsetime 202, 1200
OUTPUT file appId, serviceName 202, serviceA
I am looking for a syntax where I can have the output: serviceA, responseTime 202, 1200 And on top of this, I want to create a chart out of this.
I was playing around with a join query and was able to create a table
index=xx | dedup appId | eval duration = RT - FT | join type=inner appId [|inputlookup tmpfile.csv | rename serviceA as URL] | table appId serviceA responsetime |where appId = appId BUT, I can not create charts with avg(responseTime).
Can someone help?
Thanks.
Amit