Below Is the query to fetch spans and calculate error rate
fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, “entity.name”), “fin-iac-rel-tnl-atm-pr”) AND matchesValue(k8s.namespace.name, $Tenant) AND in(dt.entity.service, classicEntitySelector(“”“type(“SERVICE”),fromRelationship.isServiceOf(type(“CLOUD_APPLICATION”),tag(“dashboard:atm”))”“”)) AND (matchesPhrase(endpoint.name, “/wasp/api”))
| summarize all=count(), by:{dt.entity.kubernetes_cluster, start_time}
| join [fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, “entity.name”), “fin-iac-rel-tnl-atm-pr”) AND in(dt.entity.service, classicEntitySelector(“”“type(“SERVICE”),fromRelationship.isServiceOf(type(“CLOUD_APPLICATION”),tag(“dashboard:atm”))”“”)) AND (matchesPhrase(endpoint.name, “/wasp/api”)) AND (http.response.status_code!=200 AND http.response.status_code!=201)
| summarize failed=count(), by:{dt.entity.kubernetes_cluster, start_time}
], kind:leftOuter, prefix:“http.”, on:{dt.entity.kubernetes_cluster, start_time}
| fieldsAdd {errorrate = http.failed/all *100}
| fieldsRemove all, http.failed
// | makeTimeseries {avg(errorrate)}, by:{interval:10m}
but I am unable to create a timeseries for error rate from the above query.
please help
changed the DQL to below, getting the trendline now but not sure how to handle null records
fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, “entity.name”), “fin-iac-rel-tnl-atm-pr”) AND matchesValue(k8s.namespace.name, $Tenant) AND in(dt.entity.service, classicEntitySelector(“”“type(“SERVICE”),fromRelationship.isServiceOf(type(“CLOUD_APPLICATION”),tag(“dashboard:atm”))”“”)) AND (matchesPhrase(endpoint.name, “/wasp/api”))
| makeTimeseries all=count(), interval: 1m
| join [fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, “entity.name”), “fin-iac-rel-tnl-atm-pr”) AND in(dt.entity.service, classicEntitySelector(“”“type(“SERVICE”),fromRelationship.isServiceOf(type(“CLOUD_APPLICATION”),tag(“dashboard:atm”))”“”)) AND (matchesPhrase(endpoint.name, “/wasp/api”)) AND (http.response.status_code!=200 AND http.response.status_code!=201)
| makeTimeseries failed=count(default: 0),interval: 1m
], kind:leftOuter, prefix:“http.”, on:{interval, timeframe}
| fieldsAdd {errorrate = http.failed[]/all[] *100}
| fieldsRemove all, http.failed
| fieldsAdd rate = arrayAvg(errorrate)
It can be achieved with much simpler query:
fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr")
AND matchesValue(k8s.namespace.name, $Tenant)
AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))"""))
AND (matchesPhrase(endpoint.name, "/wasp/api"))
| makeTimeseries { all=count(), http.failed=countif(http.response.status_code!=200 AND http.response.status_code!=201) }, interval:10m
| fields errorrate=100*http.failed[]/all[], interval, timeframe
and if you want to have breakdown by k8s cluster, just add:
fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr")
AND matchesValue(k8s.namespace.name, $Tenant)
AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))"""))
AND (matchesPhrase(endpoint.name, "/wasp/api"))
| makeTimeseries { all=count(), http.failed=countif(http.response.status_code!=200 AND http.response.status_code!=201) }, interval:10m
, by: {dt.entity.kubernetes_cluster}
| fields errorrate=100*http.failed[]/all[], interval, timeframe, dt.entity.kubernetes_cluster
can you please help why is this DQL not working
Spans table has “start_time” and “and_time” fields. You need to specify which you want to use as a time to aggregate. Something like in example below:
fetch spans
| makeTimeseries count(), time:start_time
