Firstly, i am trying to separate 1) cachekey=false in one query and 2) cachekey=true in another query and 3) with both combined in one query. also i want avg response time and perc90 response time. where i am facing difficulty is the count 1 and 2 conbined is not equal to the count in query #3, dont know where it went wrong in the query, experts please spare some time pull me out of this.
Below are the query how i wrote
1) index=datapower CVSEVENT=EXIT opName="ABCD" status="SUCCESS" [search index=datapower opName=" 1234" cache ="false" | dedup grid | fields grid ]
| dedup grid
| table respTime, grid | stats avg(respTime), perc90(respTime), count
2) index=datapower opName="ABCD" status="SUCCESS" [search index=datapower opName="1234" cache ="true" | dedup grid | fields grid ]
| dedup grid
| table respTime, grid | stats avg(respTime), perc90(respTime), count
3) index=datapower opName="ABCD" OR opName="1234" status="SUCCESS" |stats avg(respTime), perc90(respTime), count by opName
Thanks,
↧