I have a search to calculate % of transactions that exceeded the threshold time.
index=my_index sourcetype = web "Time taken for service " | rex "call: (?<duration>[0-9]+)ms" | eval sla_level=if(duration>5000,"SLA_BREACH","OK") | top sla_level | where sla_level="SLA_BREACH" | fields + percent
This search calculates and displays percentage in the selected time range. However, I am trying to get hourly SLA Breach report. I tried using timechart, but getting errors. How do I get hourly chart?
Example,
9 AM to 10 AM - if total transactions are 100 and 8 transactions took more than 5 secs.
10 AM to 11 AM - if total transactions are 200 and 10 transactions took more than 5 secs.
11 AM to 12 AM - if total transactions are 100 and 10 transactions took more than 5 secs.
12 AM to 1 PM - if total transactions are 100 and 5 transactions took more than 5 secs.
I want to see
_time percent
2015-10-13 09:00 8
2015-10-13 10:00 5
2015-10-13 11:00 10
2015-10-13 12:00 5
Like this:
index=afm sourcetype = web "Time taken for service " | rex "call: (?<duration>[0-9]+)ms" | eval sla_level=if(duration>5000,"SLA_BREACH","OK") | timechart span=1h count AS Total count(eval(sla_level="SLA_BREACH")) AS Breaches | eval percent = 100*Breaches/Total
Like this:
index=afm sourcetype = web "Time taken for service " | rex "call: (?<duration>[0-9]+)ms" | eval sla_level=if(duration>5000,"SLA_BREACH","OK") | timechart span=1h count AS Total count(eval(sla_level="SLA_BREACH")) AS Breaches | eval percent = 100*Breaches/Total