I am trying to sum a set of values from some JSON files. The structure of the response is identical, but I want to group the sum by metricid. My basic search does gives me a count by metric ID, but then I can't seem to be able to calculate a percentage. I want to be able to calculate my health by substracting the very slow calls from the total number of calls and *100/ total number of calls.
index="xxx" source="E:\\path\\REST\\test*" metricId!=9011737 metricId!=9012116 | stats sum(metricValues{}.sum) by metricId
Below is an example of my data:
{
"frequency": "ONE_MIN",
"metricId": 90188,
"metricName": "BTM|Application Summary|Component:6710|Number of Very Slow Calls",
"metricPath": "Overall Application Performance|xxx Core|Number of Very Slow Calls",
"metricValues": [ {
"count": 155,
"current": 3,
"max": 0,
"min": 0,
"occurrences": 0,
"standardDeviation": 0,
"startTimeInMillis": 1477421100000,
"sum": 552,
"useRange": false,
"value": 552
}]
}
{
"frequency": "ONE_MIN",
"metricId": 9011736,
"metricName": "BTM|Application Summary|Component:6710|Calls per Minute",
"metricPath": "Overall Application Performance|XXX Core|Calls per Minute",
"metricValues": [ {
"count": 397,
"current": 0,
"max": 0,
"min": 0,
"occurrences": 0,
"standardDeviation": 0,
"startTimeInMillis": 1477421100000,
"sum": 81332,
"useRange": false,
"value": 5423
}]
}
Assuming your JSON is well formed and all fields are extracted, try putting your field name within single or double quotes
index="xxx" source="E:\\path\\REST\\test*" metricId!=9011737 metricId!=9012116 | stats sum('metricValues{}.sum') as total by metricId
*OR*
index="xxx" source="E:\\path\\REST\\test*" metricId!=9011737 metricId!=9012116 | rename 'metricValues{}.sum' AS s | stats sum(s) as total by metricId