Hello! Try this:
sourcetype=iis tag=webserver cs_uri_stem="/SearchQuery*" earliest=-3w@w latest=now |bucket span=7d _time|stats avg(TimeTakenMS) by cs_uri_stem, _time
Hi Stephane I am actually aiming for a result that will look something like this:
cs_uri_stem Week1 Week2 Week3
/SearchQuery1 123 122 110
/SearchQUery2 43 54 49
I am trying to tweak what you have given though it should be near enough.
Thank you so much.
Here is what i can do for you. Instead of Week1, Week2, ... in your table, you can say, week of 10/April, week of 18/April......
Something like this:
sourcetype=iis tag=webserver cs_uri_stem="/SearchQuery*" earliest=-3w@w latest=now |bucket span=7d _time| eval day_week=strftime(_time, "%d/%b")|replace * with "week of *" in day_week|stats avg(TimeTakenMS) by cs_uri_stem, day_week
Can you please share the expected output?
Thanks!!
Hi I am trying to get this output:
cs_uri_stem Week1 Week2 Week3
/SearchQuery1 123 122 110
/SearchQUery2 43 54 49
where week columns are derived from the same daytime value per week.
TIA