The following version of this search runs over 7-10 days successfully. I want to make a summary index instead, so I can reliably get a month's data. Am I doing this correctly?
index="myIndex" sourcetype=mySourcetype (msg=REQ* OR msg=RSP) (source="E:\\Logs\\Path-*" source!="E:\\Logs\\Path-Test*") (data.HostType<1000 AND data.HostType!=0)
| fields data.CompanyNumber, data.ElapsedSeconds, HostName, data.IsApproved, cid, msg
| stats
max(data.ElapsedSeconds) as ElapsedSeconds,
max(eval(if('data.IsApproved'="false",1,0))) as declines,
by cid, HostName
| stats dc(cid) as txnsPerHost
avg(ElapsedSeconds) as avgElapsedSeconds
max(ElapsedSeconds) as maxElapsedSeconds
sum(declines) as declines
by HostName
| addinfo
| eval totalSeconds = round(info_max_time - info_min_time)
| eval tps=round((txnsPerHost/totalSeconds),2)
| eval avgElapsedSeconds = round(avgElapsedSeconds,2)
| eval maxElapsedSeconds = round(maxElapsedSeconds,2)
| fields HostName txnsPerHost tps avgElapsedSeconds maxElapsedSeconds declines
| sort 0 -txnsPerHost
Summary creating search:
index="myIndex" sourcetype=mySourcetype (msg=REQ* OR msg=RSP) (source="E:\\Logs\\Path-*" source!="E:\\Logs\\Path-Test*") (data.HostType<1000 AND data.HostType!=0)
| fields data.CompanyNumber, data.ElapsedSeconds, HostName, data.IsApproved, cid, msg
| stats
max(data.ElapsedSeconds) as ElapsedSeconds,
max(eval(if('data.IsApproved'="false",1,0))) as declines,
by cid, HostName
| collect index=mySummaryIndex
Search using the summary:
index=mySummaryIndex
| stats dc(cid) as txnsPerHost
avg(ElapsedSeconds) as avgElapsedSeconds
max(ElapsedSeconds) as maxElapsedSeconds
sum(declines) as declines
by HostName
| addinfo
| eval totalSeconds = round(info_max_time - info_min_time)
| eval tps=round((txnsPerHost/totalSeconds),2)
| eval avgElapsedSeconds = round(avgElapsedSeconds,2)
| eval maxElapsedSeconds = round(maxElapsedSeconds,2)
| fields HostName txnsPerHost tps avgElapsedSeconds maxElapsedSeconds declines
| sort 0 -txnsPerHost
... View more