I am trying to get the transaction results from a lookup file and I have _time field written into it for this to work. The duration condition seems to be working, but the query stops working the moment I add maxpause condition to it. Below is the query I am currently trying to fix. Please help me here. | inputlookup LOOKUP.csv | eval durationLimitInSeconds=durationLimitInMinutes*60 | eval now=now() | eval temp=(now-(2*60*60)-120) | where _time>temp | transaction maxpause=10s code | where eventcount>2 AND duration>durationLimitInSeconds | fields _time code duration durationLimitInSeconds eventcount Below is the sample data, if it helps. I want events with pause more than a few seconds (10s) to be considered as a different transaction, but the query I use treats all of them as single event and if I include maxpause, the query doesn't work at all. _time duration_measure code loglevel durationLimitInMinutes 2017-03-17 00:25:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:21 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:21 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:11 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:11 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:27 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:27 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:45 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:45 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:19:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:57 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:12 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 ... View more

I am trying to get the number of requests/response that we send/receive to/from one application and the combined size of request & responses per hour. I am using the below query, but this doesn't seem to work. index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eventstats sum(raw_len), count by date_hour, Direction I need results in the below table format... date.hour NumberofRequests(direction=REQUEST) Number of Responses (direction=RESPONSE) Sum(bytes) Can someone please help me with this? Thanks. ... View more

I am using the below query to get the status codes of different applications which have one common functionality...I need to add the % by index.. Can someone please help me? Thanks. index=* sourcetype=access* URL="/bankapi/accounts/*/transactions/*/checkimages*" | top StatusCode by index Below are the results... index StatusCode count percent bankapi_logs 200 616 98.402556 bankapi_logs 500 10 1.597444 olb_logs 200 5563 98.338342 olb_logs 500 52 0.919215 olb_logs 404 32 0.565671 olb_logs 503 10 0.176772 I need something like this... index StatusCode count percent bankapi_logs 200 616 98.402556 bankapi_logs 500 10 1.597444 BankAPI.Total 100 olb_logs 200 5563 98.338342 olb_logs 500 52 0.919215 olb_logs 404 32 0.565671 olb_logs 503 10 0.176772 OLB.Total 100 ... View more

I need to display the current hour and the current hour + 1 values in the chart and I am using the below eval function for the same... eval monthDateHour=date_month.".".date_mday." ".date_hour.":"."00"." - "."date_hour+1" But it doesn't work. Can someone please help me? Thanks. ... View more

I need to draw a simple graph of all the response times for a particular service in my application. I am using the below query for now, but i do not want average. I want all the response times on 'y' and _time on 'x' and the graph showing them. There are more than 1 call per second and avg doesn't actually represent the issue we are trying to resolve. Thanks a lot. index=jms_logs sourcetype=perflogs operation_name="RSA*" | timechart span=1s avg(response_time) ... View more

I am using the below query, but few events in the logs don't have service_name values. They only have operation_name. I need to include these events in the results with only the operation name. Please help me. index=jms_logs sourcetype=perflogs | eval service_operation = service_name.".".operation_name | table service_operation | dedup service_operation | sort service_operation thanks. ... View more

I need the 90th percentile value in a series of values and the count of values that are greater than the 90th percentile... I am trying the below query with no luck. Please help me. index=jms_logs sourcetype=perflogs domain_server_port="proda_olb_osb*" service_name="ABC*" | eventstats perc95(response_time) as response_time_95p | stats count by service_name | where response_time>response_time_98p ... View more

I need a table which gives me both perc95(response_time) and avg(response_time) by service_name I am using the below query, but is giving me some weird results... index=jms_logs sourcetype=perflogs | eventstats perc95(response_time) as response_time_95p, avg(response_time) as avgRespTime | stats by service_name can someone please help me? Thanks. ... View more

in weblogic access log, i need to join 2 results and use transaction to display the calls within 3s timespan, but this doesn't work. Can you please help me? index=olb_logs sourcetype="access-API" URL="/bankapi/session" method=POST | join sessionID [Search URL="/bankapi/accounts" method=GET] | transaction sessionID maxspan=3s ... View more