This is my query Sample: index=X service_name=XY request_host=XYZ | rex field=_raw "FId=(?<fi>\d+)" | rex field=request_route "^(?<route>.*)\?" | rex field=_id "^(?<route>.*)\?" | eval eTime = tota...
See more...
This is my query Sample: index=X service_name=XY request_host=XYZ | rex field=_raw "FId=(?<fi>\d+)" | rex field=request_route "^(?<route>.*)\?" | rex field=_id "^(?<route>.*)\?" | eval eTime = total_time | lookup FI_Name-ICA.csv ICA AS fi OUTPUT FI as fi | stats count(total_time) as TotalCalls, max(eTime) AS MaxTime, avg(eTime) as AvgTime, min(eTime) as MinTime,p90(total_time) as P90Time,p95(total_time) as P95Time by fi route | sort route, -count | table fi, route, TotalCalls,MaxTime,MinTime,P90Time,P95Time,AvgTime | sort by fi I am trying to add columns for calls that took between 0 to 3 seconds 3 to 5 and > 8 seconds ???