Firstly, i am trying to separate 1) cachekey=false in one query and 2) cachekey=true in another query and 3) with both combined in one query. Also i want avg response time and perc90 response time. Where i am facing difficulty is that count 1 and 2 combined is not equal to the count in query #3. I don't know where it went wrong in the query. Experts please spare some time to pull me out of this.
Below are the query how i wrote
1)
index=datapower CVSEVENT=EXIT opName="ABCD" status="SUCCESS" [search index=datapower opName=" 1234" cache ="false" | dedup grid | fields grid ]
| dedup grid
| table respTime, grid | stats avg(respTime), perc90(respTime), count
2)
index=datapower opName="ABCD" status="SUCCESS" [search index=datapower opName="1234" cache ="true" | dedup grid | fields grid ]
| dedup grid
| table respTime, grid | stats avg(respTime), perc90(respTime), count
3)
index=datapower opName="ABCD" OR opName="1234" status="SUCCESS" |stats avg(respTime), perc90(respTime), count by opName
Thanks.
... View more