I am working on a dashboard query where I want to have a count of all the transactions that took more than a certain amount to complete.
My query is something like:
fields message
| filter kubernetes.namespace_name = 'feature-7355'
| filter message like "INFO"
| filter message like "Metric"
| parse '[*] * [*] * - *' as logLevel, timeStp, threadName, classInfo, logMessage
| parse logMessage 'Header: [*]. Metric: [*]. TimeSpent: [*]. correlationId: [*]' as headers, metric, timeSpent, correlationId
| filter ispresent(correlationId)
| stats sum(timeSpent) as TotalTimeSpentByTransaction by correlationId
| filter TotalTimeSpentByTransaction > 2000
| stats count(timeCorrelationId) as correlationIdCount
When I try to execute this I am getting an error:
mismatched input 'stats' expecting {K_PARSE, K_SEARCH, K_FIELDS, K_DISPLAY, K_FILTER, K_SORT, K_ORDER, K_HEAD, K_LIMIT, K_TAIL}
Is there a way to work this out, Can someone help me resolve this?