Hi together, I try to compare the PERC90 response times of an application before and after a software release for the 50 most used actions. Here's the query index=myindex source=mysource | rex field=_raw "^(?:[^;\n]*;){4}\s+(?P<utc_tsl_tranid>\w+:\w+)" | rex field=_raw "^.+\/(?P<ui_locend>\w+\.[a-z_-]+\.\w+\.\w+)" | dedup utc_tsl_tranid | stats sum(DURATION) as weight by ui_locend | sort - weight | head 50 Is there a way I can compare 2 time periods (for example: first start 2024-08-10 end 2024-08-15, second start 2024-08-20 end 2024-08-25). Field ui_locend has to match and I like to compare PERC(90) of DURATION, which can be calculated with STATS-Command. It's a tricky one, will appreciate every idea.
... View more
