Query I am running:
index="dcg-video-eng-live-services-stage" | spath "message.req.originalUrl" | search "message.req.originalUrl"!="/health-check"| spath severity | search severity!=warn|search message.extraLogInfo./api2/asset/get.assets{}.desc!=null()
|table _time message.extraLogInfo./api2/asset/get.assets{}.desc message.extraLogInfo./api2/asset/get.assets{}.duration
| rename message.extraLogInfo./api2/asset/get.assets{}.desc as Channel, message.extraLogInfo./api2/asset/get.assets{}.duration as Duration
|sort -_time
This results in the following table:
https://drive.google.com/open?id=1PaUuxMNy29QYtjzKbc2i0ulGybXXSnL6 (also shown in image)
As shown in the image, the results have varying time intervals.
I want to get the results in the table to be in time intervals of 3s.
How do I go about doing it?
Thanks!
Hi,
Can you try the below search,
index="dcg-video-eng-live-services-stage" | spath "message.req.originalUrl" | search "message.req.originalUrl"!="/health-check"| spath severity | search severity!=warn|search message.extraLogInfo./api2/asset/get.assets{}.desc!=null()
|table _time message.extraLogInfo./api2/asset/get.assets{}.desc message.extraLogInfo./api2/asset/get.assets{}.duration
| rename message.extraLogInfo./api2/asset/get.assets{}.desc as Channel, message.extraLogInfo./api2/asset/get.assets{}.duration as Duration
|sort -_time
| mvexpand Channel
| mvexpand Duration
| bin span=3s _time
| stats values(Channel) as Channel, values(Duration) as Duration by _time
Hi,
Can you try the below search,
index="dcg-video-eng-live-services-stage" | spath "message.req.originalUrl" | search "message.req.originalUrl"!="/health-check"| spath severity | search severity!=warn|search message.extraLogInfo./api2/asset/get.assets{}.desc!=null()
|table _time message.extraLogInfo./api2/asset/get.assets{}.desc message.extraLogInfo./api2/asset/get.assets{}.duration
| rename message.extraLogInfo./api2/asset/get.assets{}.desc as Channel, message.extraLogInfo./api2/asset/get.assets{}.duration as Duration
|sort -_time
| mvexpand Channel
| mvexpand Duration
| bin span=3s _time
| stats values(Channel) as Channel, values(Duration) as Duration by _time
It is giving me the 3s interval. Thanks 🙂
But its also giving me other data I don't want. Sorta combining two mv values
But on explicitly eliminating that data using '!=', I got what I wanted 🙂
Thank you!!
Cool.please accept it as answer if it is resolved your issue.
Hey..I'm seeing a problem, the time stamp is repeating in some cases
Never mind, used dedup 😛
try adding at the end
| bin _time span=3s | stats values(channel), values(duaration)
Nope.
The results are mv and without a timestamp.