All,
I have an index with some fields like appId and responsetime. I also have a dataset where the appId is same, but in this file I have a propername linked with the appId
So as example
INDEX OUTPUT
appId, responsetime
202, 1200
OUTPUT file
appId, serviceName
202, serviceA
I am looking for a syntax where I can have the output:
serviceA, responseTime
202, 1200
And on top of this, I want to create a chart out of this.
I was playing around with a join query and was able to create a table
index=xx | dedup appId | eval duration = RT - FT | join type=inner appId
[|inputlookup tmpfile.csv | rename serviceA as URL]
| table appId serviceA responsetime
|where appId = appId
BUT, I can not create charts with avg(responseTime).
Can someone help?
Thanks.
Amit
You dont need to use join here when the data is in lookup file and for charts you can use stats command , you can try something like below -
$FirstQuery which gives appId and reponseTime as output$
| lookup tmpfile.csv appId AS appId output serviceA
| stats avg(responseTime) AS responseTime by appId,serviceA
Thank for the response.
I tried, but this is not working. Also I need to remove the dedup, otherwise it will take only one event.
The thing is de index output results in many appId's with some responsetime. I need to make this into a chart, linked with the servicename (which is not there in the index output).
Any tips how to proceed?
Thanks