Multiple Lines In a Line Chart
I have a line chart that shows response times over time for a given transaction. I’d like to show a few transactions in this line chart but I am not sure how to do this. Is this even possible?
My search that shows login response times over time is here:
_sourceCategory=demo transactionName=Login | timeslice 15m | avg(responseTime) as ms by _timeslice
Rather than have a separate line chart showing logout response times, I’d like to add logout response times to my existing line chart. I tried something like this, which does not work:
_sourceCategory=demo transactionName=Login OR transactionName=Logout | timeslice 15m | avg(responseTime) as ms by transactionName,_timeslice
Thanks in advance,
Chris
-
Hi Chris,
It looks like you may be close. What you will want to do is add a transpose statement to get each transaction type into it's own column. These should then appear as multiple lines on the chart. Give the following a try.
_sourceCategory=demo transactionName=Login OR transactionName=Logout
| timeslice 15m
| avg(responseTime) as ms by transactionName,_timeslice
| transpose row _timeslice column transactionName -
One other thing to add is that if you choose a bar graph for your visualization option, you can change the settings so that that the results are stacked. I find the this helps me better visualize which entity (in your case, transactionName) has the highest response time out of the group of transactions.
-
Hi there. Following up on this question, I have 4 values that I want to chart with trend lines. I have values for CheckOut and CheckIn activities, and the response time for each in milliseconds. I'm able to graph the 2 actions in one graph so far, but I'd like to graph all 4 lines (CheckOuts, Checkout-Response time, CheckIns, CheckIn-Response Time) in the same graph. Is that possible?
Here's my query:
"Token Checkout Time:" or "Token Checkin Time:"
| parse "Token * Time: *ms" as action, time
| timeslice 5m
| avg(time) as RespTime_ms by action, _timeslice
| transpose row _timeslice column actionAnd the data looks like this:
2018-11-27 22:39:48,826 RD0003FFA6420F SomeAppName Info [13] "Token CheckOut Time: 31.2514ms "
2018-11-27 22:39:48,576 RD0003FF580BAC SomeAppName Info [54] "Token CheckIn Time: 93.7832ms "
2018-11-27 22:39:47,661 RD0003FF580BAC SomeAppName Info [54] "Token CheckOut Time: 83.7676ms "
2018-11-27 22:39:47,594 RD0003FFA64032 SomeAppName Info [15] "Token CheckIn Time: 108.7173ms "Thanks!
-Guillermo
Please sign in to leave a comment.
Comments
4 comments