Log format
ServiceName,ResponseTime,RequestTime,TransactionId
Service1,10,12,12345
Service2,5,8,12346
Service2,7,3,12347
Service1,8,25,12348
Service3,5,4,12349
Service2,10,2,12350
Expected result
Service Name Count Max(ResponseTime) RequestTime TransactionId
Service1 2 10 12 12345
Service2 3 10 2 12350
Service3 1 5 4 12349
I am able to get the service name,count and ResponseTime using the below search. But i need RequestTime and TransactionId based on Max(ResponseTIme). I need the RequestTime and TransactionId of the record which has Max(ResponseTime). Do i really need sub search to get the desired results?
my rex | stats count,max(ResponseTime) by ServiceName
... View more