Is it possible to do a conditional count using tstats? I'm trying use the following which is the syntax that I would use for a non tstats search, but it doesn't work. count(eval("Performance.duration" > 2500)) AS violation
Complete search:
| tstats count(eval("Performance.duration" > 2500)) AS violation exactperc99("Performance.duration") AS "perc99" from datamodel=PerformanceMetrics where (nodename = PerformanceMetricBaseSearch) (PerformanceMetricBaseSearch.duration="*") groupby PerformanceMetric _time span=15m
Here's how I did it without changing the data model.
My goal was to see what percentage of API calls returned in under 1 second and under 3 seconds.
| tstats summariesonly=t prestats=t count from datamodel=rest_api
BY object.apiName
| eval perfThreshold="Total"
| tstats summariesonly=t prestats=t append=t count from datamodel=rest_api
WHERE object.responseTime<=1000
BY object.apiName
| eval perfThreshold=case(isnotnull(perfThreshold), perfThreshold, true(), "Below1sec")
| tstats summariesonly=t prestats=t append=t count from datamodel=rest_api
WHERE object.responseTime<=3000
BY object.apiName
| eval perfThreshold=case(isnotnull(perfThreshold), perfThreshold, true(), "Below3sec")
| rename object.* as *
| chart count by apiName perfThreshold
| eval pctBelow1Sec=100 * Below1sec / Total
| eval pctBelow3Sec=100 * Below3sec / Total
| table apiName pctBelow1Sec pctBelow3Sec Total
Hope this helps.
I have been able to do this with adding another tstats string using append=true, however curious if it can be done without having to do that
@cramasta - do you think you could post an example?
One way you could try is add a new field to your datamodel. eval newfield=if("Performance.duration" > 2500, 1, 0)
and in your search do | tstats sum(newfield) as violation