We are pushing in [json] events with a timestamp field that contains time since epoch in milliseconds, eg:
{[-]
name : "fetch.thing",
correlationId: 'xyz',
timestamp : 1366040759635
}
when I try to do query :
* | spath name | transaction correlationId | chart max(duration) by correlationId
The durations are all 0 despite the timestamps not being the same.
I suspect this is because the duration is in seconds.
Is this the case?
If so, is it possible to display duration in milliseconds?
Thanks, Tom
As far as I know you can only get durations in seconds from the transaction
command. But, transaction
is expensive and can often be replaced with stats
like this in this case. And, you get the benefit of solving your problem while you're at it 🙂
This should do it (obviously untested though):
* | spath | stats range(timestamp) as durationms by correlationId | eval duration=durationms/1000