I have a log that records a transaction name, channel and timing information and need to calculate the maximum rate/minute for each transaction. Something along the lines of
index=web_load sourcetype=instrument
| eval Transaction=i_tx.":".i_chn
| bucket _time span=1m
| top 1 _time showperc=false by Transaction
but I also want to show the corresponding min, average, max, perc95 elapsed time for that associated minute from the i_elapsed field, something like I can get from
index=web_load sourcetype=instrument
| eval Transaction=i_tx.":".i_chn
| stats count as Count, min(i_elapsed) as Min, avg(i_elapsed) as Avg, max(i_elapsed) as Max, perc95(i_elapsed) as 95th by Transaction
How can I get the min/max/avg/perc95 numbers into the table or the rate into the stats table?
↧