i wanted to omit data for non-business hours and weekends. i have tried this below query and not getting any results - added this portion -->  eval hour = tonumber(strftime(_time,"%H")) | eval dow = tonumber(strftime(_time,"%w")) | where hour>=6 AND hour<=18 AND dow!=0 AND dow!=6 | mstats sum(builtin:apps.web.actionCount.load.browser:parents) As "Load_Count1",avg(builtin:apps.web.visuallyComplete.load.browser:parents) As "Avg_Load_Response1",sum(builtin:apps.web.actionCount.xhr.browser:parents) As "XHR_Count1",avg(builtin:apps.web.visuallyComplete.xhr.browser:parents) As "Avg_Xhr_Response1" where index=itsi_im_metrics AND source.name="DT_Prod_SaaS" AND entity.browser.name IN ("Desktop Browser","Mobile Browser") AND entity.application.name ="xxxxx" earliest=-31d@d latest=@d-1m by entity.application.name | eval hour = tonumber(strftime(_time,"%H")) | eval dow = tonumber(strftime(_time,"%w")) | where hour>=6 AND hour<=18 AND dow!=0 AND dow!=6 | eval Avg_Load_Response1=round((Avg_Load_Response1/1000),2),Avg_Xhr_Response1=round((Avg_Xhr_Response1/1000),2),Load_Count1=round(Load_Count1,0),XHR_Count1=round(XHR_Count1,0) | table entity.application.name,Avg_Load_Response1   ... View more

Modified Query ============   | mstats sum(builtin:apps.web.actionCount.load.browser:parents) As "Load_Count1",avg(builtin:apps.web.visuallyComplete.load.browser:parents) As "Avg_Load_Response1",sum(builtin:apps.web.actionCount.xhr.browser:parents) As "XHR_Count1",avg(builtin:apps.web.visuallyComplete.xhr.browser:parents) As "Avg_Xhr_Response1" where index=itsi_im_metrics AND source.name="DT_Prod_SaaS" AND entity.browser.name IN ("Desktop Browser","Mobile Browser") AND entity.application.name ="xxxxx" earliest=-31d@d latest=@d-1m by entity.application.name | eval hour = tonumber(strftime(_time,"%H")) | eval dow = tonumber(strftime(_time,"%w")) | where hour>=6 AND hour<=18 AND dow!=0 AND dow!=6 | eval Avg_Load_Response1=round((Avg_Load_Response1/1000),2),Avg_Xhr_Response1=round((Avg_Xhr_Response1/1000),2),Load_Count1=round(Load_Count1,0),XHR_Count1=round(XHR_Count1,0) | table entity.application.name,Avg_Load_Response1 ... View more

Original Query ============ | mstats sum(builtin:apps.web.actionCount.load.browser:parents) As "Load_Count1",avg(builtin:apps.web.visuallyComplete.load.browser:parents) As "Avg_Load_Response1",sum(builtin:apps.web.actionCount.xhr.browser:parents) As "XHR_Count1",avg(builtin:apps.web.visuallyComplete.xhr.browser:parents) As "Avg_Xhr_Response1" where index=itsi_im_metrics AND source.name="DT_Prod_SaaS" AND entity.browser.name IN ("Desktop Browser","Mobile Browser") AND entity.application.name ="xxxxxx" earliest=-31d@d latest=@d-1m by entity.application.name | eval Avg_Load_Response1=round((Avg_Load_Response1/1000),2),Avg_Xhr_Response1=round((Avg_Xhr_Response1/1000),2),Load_Count1=round(Load_Count1,0),XHR_Count1=round(XHR_Count1,0) | table entity.application.name,Avg_Load_Response ... View more

using mpreview command to explore the results  | mpreview index=itsi_im_metrics | search "calc:service.thaa_stress_requests_lr_tags" "Dimension.id"="*Process.aspx" Those values with '0' is not actual response, for some reason these entries are there and its affecting the overall average response. so wanted to remove those values from the calculation.    instead of this --> (4115725 + 0 + 3692799) / 3, i want this --> (4115725 + 3692799) / 2 ... View more

yes tried it out with all options already, with quote, without quote & double quotes. All are giving the same error. Error in 'mstats' command: Invalid token: sum(eval(if(calc:service.thaa_stress_requests_count_lr_tags>0   ... View more

getting error -  Error in 'mstats' command: Invalid token:  sum(eval(if('calc:service.thaa_stress_requests_count_lr_tags'>0 ... View more

sample Payload =========   sample payload: Dimension.id: xxxProcess.aspx Dimension.name: Literal Not Found MessageDeduplicationId: a901b712889217fc194cd0446a70325e aggregation: avg entity.service.id: xxx entity.service.name:xxxx metric_name:calc:xxxx_ lr_tags: 1613759 resolution: 1m s ource.name: xxxx unit: MicroSecond ... View more

Modified Query ==========   | mstats sum(calc:service.thaa_stress_requests_count_lr_tags) As "Count" ,avg(calc:service.thaa_stress_requests_lr_tags) As "Response" where index=itsi_im_metrics AND source.name="DT_NonProd_SaaS" by Dimension.id | eval Response=round((Response/1000000),2), Count=round(Count,0) | search Dimension.id IN ("*Process.aspx") | dedup MessageDeduplicationId ... View more

Initial Query ==========   | mstats sum(calc:service.thaa_stress_requests_count_lr_tags) As "Count" ,avg(calc:service.thaa_stress_requests_lr_tags) As "Response" where index=itsi_im_metrics AND source.name="DT_NonProd_SaaS" by Dimension.id | eval Response=round((Response/1000000),2), Count=round(Count,0) | search Dimension.id IN ("*Process.aspx") ... View more

Yes i have tried with Search command as well, but no luck.   index="dynatrace" sourcetype="dynatrace:usersession" | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="test" | spath output=pp_user_action_name input=user_actions path=name | search pp_user_action_name in ([| inputlookup test.csv]) | spath output=pp_user_action_response input=user_actions path=visuallyCompleteTime | eval pp_user_action_name=substr(pp_user_action_name,0,150) | eventstats avg(pp_user_action_response) AS "Avg_today" by pp_user_action_name | stats count(pp_user_action_response) As "Today_Calls",perc90(pp_user_action_response) AS "Perc90_today" by pp_user_action_name Avg_today | eval Perc90_today=round(Perc90_today/1000,2)| eval Avg_today=round(Avg_today/1000,2) | table pp_user_action_name,Today_Calls,Avg_today,Perc90_today ... View more

This is nice idea. I have come up with this query for 2 different time frames. Its retrieving/calculating the data for shorter timeframes (Ex: up to 3hours range). But for longer time frame, getting partial data for the fields 'p90Avg_PageRenderingTime' or 'p90Avg_PageRenderingTime1'. PFA image.  index="dynatrace" sourcetype="dynatrace:usersession" earliest=-50h@h latest=-46h@h | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="*****" | spath output=pp_user_action_name input=user_actions path=name | where pp_user_action_name in ("") | eval pp_user_action_name=substr(pp_user_action_name,0,60) | spath output=pp_user_action_response_VCT input=user_actions path=visuallyCompleteTime | stats count(pp_user_action_response_VCT) As "Count",avg(pp_user_action_response_VCT) AS "Avg_PageRenderingTime" by pp_user_action_name | join type=left [search index="dynatrace" sourcetype="dynatrace:usersession" earliest=-50h@h latest=-46h@h | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="*****" | spath output=pp_user_action_name input=user_actions path=name | where pp_user_action_name in ("") | eval pp_user_action_name=substr(pp_user_action_name,0,60) | spath output=pp_user_action_response_VCT input=user_actions path=visuallyCompleteTime | eventstats p90(pp_user_action_response_VCT) AS "p90_PageRenderingTime" by pp_user_action_name | where pp_user_action_response_VCT<=p90_PageRenderingTime | stats count(pp_user_action_response_VCT) As "Count1",avg(pp_user_action_response_VCT) AS "p90Avg_PageRenderingTime" values(p90_PageRenderingTime) by pp_user_action_name ] | join type=left [search index="dynatrace" sourcetype="dynatrace:usersession" earliest=-74h@h latest=-70h@h | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="*****" | spath output=pp_user_action_name input=user_actions path=name | where pp_user_action_name in ("") | eval pp_user_action_name=substr(pp_user_action_name,0,60) | spath output=pp_user_action_response_VCT input=user_actions path=visuallyCompleteTime | stats count(pp_user_action_response_VCT) As "Count2",avg(pp_user_action_response_VCT) AS "Avg_PageRenderingTime1" by pp_user_action_name ] | join type=left [search index="dynatrace" sourcetype="dynatrace:usersession" earliest=-74h@h latest=-70h@h | spath output=user_actions path="userActions{}" | stats count by user_actions | spath output=pp_user_action_application input=user_actions path=application | where pp_user_action_application="*****" | spath output=pp_user_action_name input=user_actions path=name | where pp_user_action_name in ("") | eval pp_user_action_name=substr(pp_user_action_name,0,60) | spath output=pp_user_action_response_VCT input=user_actions path=visuallyCompleteTime | eventstats p90(pp_user_action_response_VCT) AS "p90_PageRenderingTime1" by pp_user_action_name | where pp_user_action_response_VCT<=p90_PageRenderingTime1 | stats count(pp_user_action_response_VCT) As "Count3",avg(pp_user_action_response_VCT) AS "p90Avg_PageRenderingTime1" values(p90_PageRenderingTime1) by pp_user_action_name ] | eval Avg_PageRenderingTime=round(Avg_PageRenderingTime,0)/1000 | eval p90Avg_PageRenderingTime=round(p90Avg_PageRenderingTime,0)/1000 | eval Avg_PageRenderingTime1=round(Avg_PageRenderingTime1,0)/1000 | eval p90Avg_PageRenderingTime1=round(p90Avg_PageRenderingTime1,0)/1000 | table pp_user_action_name, Count,Avg_PageRenderingTime,p90Avg_PageRenderingTime,Count2,Avg_PageRenderingTime1,p90Avg_PageRenderingTime1 Any suggestions?  thanks in advance.  ... View more

Thanks. i am all set.  ... View more

its working. can we append any string with this date? For Ex: 11/1/2023_Response ... View more

if i am using preset time frames (Ex: last 60 minutes), then getting -->2023-10-25T13:34:05.040-04:00 Relative (Ex: 30 Minutes Ago) --> 2023-10-25T13:37:03.206-04:00 Real time (Ex: 30 Minutes Ago) --> No search results returned Date Range (Ex: since 10/24/2023) --> No search results returned Date & Time Range (Ex: 10/24/2023 12AM - 10/24/2023 1AM) --> No search results returned Advanced --> (Ex: Earliest=-1h@h Latest=@h) --> 2023-10-25T12:59:59.762-04:00 Here is the sample userActions{} object userActions: [ [-] { [-] apdexCategory: TOLERATING application: xxxx cdnBusyTime: null cdnResources: 0 cumulativeLayoutShift: 0.0535 customErrorCount: 0 dateProperties: [ [+] ] documentInteractiveTime: 4208 domCompleteTime: 4585 domContentLoadedTime: 4492 domain: xxxx doubleProperties: [ [+] ] duration: 4589 endTime: 1698253596232 firstInputDelay: 1 firstPartyBusyTime: 1618 firstPartyResources: 46 frontendTime: 1387 internalApplicationId: APPLICATION-99C2CEC2F57DD796 javascriptErrorCount: 0 keyUserAction: false largestContentfulPaint: 3926 loadEventEnd: 4589 loadEventStart: 4588 longProperties: [ [+] ] matchingConversionGoals: [ [+] ] name: xxxx.aspx navigationStart: 1698253591643 networkTime: 1235 requestErrorCount: 0 requestStart: 775 responseEnd: 3202 responseStart: 2742 serverTime: 1967 speedIndex: 3956 startTime: 1698253591643 stringProperties: [ [+] ] targetUrl: xxxx.aspx thirdPartyBusyTime: null thirdPartyResources: 0 totalBlockingTime: null type: Load userActionPropertyCount: 0 visuallyCompleteTime: 4166   ... View more

tried this and not getting any results for the sub query    | appendcols [ search index="dynatrace"  [| makeresults | eval earliest=relative_time(now(),"$tr_14AGuxUA.earliest$"), latest=relative_time(now(),"$tr_14AGuxUA.latest$") | table earliest latest] | spath output=user_actions path="userActions{}" | stats count by user_actions ... View more

If i use this in the sub query - earliest=$tr_14AGuxUA.earliest$ latest=$tr_14AGuxUA.latest$, then getting this error    Invalid value "2023-10-16T14:00:00.000Z" for time term 'earliest' ... View more

its working now.... thanks  ... View more