How to filter my search and only return results if response time is greater than median time?

[xvxt006]

Hi,

I would like to get results only if response time is greater than median time. I have used below query. But for some reason it shows all the values. Also can you let me know if this is efficient way of doing it?

my search | eventstats p50(Time1) as Time | append [search my search| where Time1> Time | stats count by Server,Env,URI,Time1 ] | table Server,Env,URI,Time1

[MuS · Accepted solution]

Hi xvxt006,

try something like this:

my search | stats p50(Time1) as pTime by Server, Env, URI, Time1 | where Time1 > pTime | table Server, Env, URI, Time1

hope that helps ...

cheers, MuS

[xvxt006]

Hi Mus,

I had tried like that but it is not really calculating median time for all the data points as we have stats by server, Env, URI, Time1. Each data point shows its Time value as median value which i don't want.

[MuS]

okay, just tested something similar and it works ... try this:

my search | eventstats p50(Time1) as pTime  | where Time1 > pTime | table Server, Env, URI, Time1

[xvxt006]

Thanks. I have tried this previously and for some reason it did not work. Now it worked. Thanks for your help.