How to split the call based on TimeTaken

[marinewcreater]

I would like to create a Pie chart to show how many calls took less than 100ms, 200ms, and 300ms. 

index=star env=prod |search time > 100 | stats count by time

How can I append > 200 and >300 in the same query? 

[acharlieh]

In addition to the `count(eval())` options with stats as have already been suggested, another option would be to create a field that classifies your events by the durations you're interested in... then stats count by that new field... 

If you have the specific ranges that you're interested in...you could use eval to construct a classifier, and then stats count by that classifier.

<base search> 
| eval classifier=case(time<100, "<100", time<200, "<200", time<300, "<300", true(), ">=300" )
| stats count by classifier

Since you have a numeric field, you could use bin to make those classifiers instead:

<base search> 
| bin time as classifier span=100 
| stats count by classifier

And of course there are many other methods of creating a classifier field (single or multi-valued), but the downside to doing a simple by clause is of course is that if you don't have a particular expected range/classifier in your data, you simply won't have that particular range in your output, which depending on your use case may be alright, or may be a problem.

[venkatasri]

@marinewcreater 

You could try stats with eval something like this , grouping them by time does not create a great pie chart you could still try it depends on number of data points, use | bin to bucket them before using by time.

index=star env=prod | searchTime > 100 | stats count(eval(searchTime>100)) as gt_100, count(eval(searchTime>200 AND searchTime<300)) as gt_200, count(eval(searchTime>300)) as gt_300 

[nmohammed]

index=star env=prod | 
chart count(eval(time <100)) AS "<100ms", count(eval(time >100 AND time <200)) AS "<200ms", count(eval(time >200 AND time <300)) AS "<300ms" 
| stats count by time 

try that query and select pie chart under visualizations.

[marinewcreater]

Error in stats command: eval is invalid