Calculate Single Value P90

[RPbiaggio]

Hi everyone, how's it going? I need to calculate the p90 response time for some services in my environment. The problem is that I need to perform a split by to, among other things, extract the service tags, which will be used as a filter. When I do the split by, I need to summarize the data, and that's where the problem arises. I'm running the code below:

timeseries
{
  latency.p90 = percentile(dt.service.request.response_time, 90, scalar: true)
},by: {dt.entity.service,endpoint.name}

| filterOut contains(endpoint.name,"health")
| filterOut contains(endpoint.name,"/swagger")

| join on: {interval, dt.entity.service, endpoint.name}, [timeseries
  {
    latency.p90.seven.days = percentile(dt.service.request.response_time, 90, scalar: true)
  }, 
  by: {endpoint.name, dt.entity.service},
  shift: -30d
  | filterOut contains(endpoint.name,"health")
  | filterOut contains(endpoint.name,"/swagger")],
  fields: { latency.p90.seven.days}


// Enriquecimento com tags do serviço
| lookup [fetch dt.entity.service], sourceField:dt.entity.service, lookupField:id, fields:tags
| fieldsAdd services.tags = tags
| expand services.tags
| parse services.tags, """ "Business Service:" DATA:business.service """
//| parse services.tags, """ "Jornada:" DATA:journey """
| parse  services.tags, """ "Owner:" DATA:owner """
| fieldsAdd dt.entity.service.name = entityName(dt.entity.service)
| filterOut contains(dt.entity.service.name,"xxxxxx")
| expand tags
| parse  tags, """ "Jornada:" DATA:journey """

| filter matchesValue(journey,"xxxxx")
| filter matchesValue(owner,"xxxxxx")


//Sumarizando para obter o resultado organizado
| summarize 
    {
    latency.p90 = percentile(latency.p90,90),
    //latency.p90 = avg(latency.p90),
    latency.p90.seven.days = percentile(latency.p90.seven.days,90)
    //latency.p90.seven.days = avg(latency.p90.seven.days)
}

I'm extracting the p90 from the timeseries and then extracting the p90 from the p90 inside the summarize. I'm not sure if this is correct.
I considered using segments, but I couldn't find a way to relate the tags to all data types, so when I run timeseries, the segment returns nothing.

Does anyone know if there's a proper way to do this DQL?

Thank you

[michiel_otten]

Hi there,

Could you please elaborate  a bit more what the expected en result needs to be? 🙂
By the way: you don't have to parse the tags to be able to search in them. You can also make them a big string and search inside that string (via the toString() method)

best regards, 
Michiel

[RPbiaggio]

Hi, @michiel_otten 

The main question here, Michel, is this:

I need to show the client, for example, consolidated availability, error, and P90 indicators, including comparisons with the previous 30 days. This should be segmented by login, card, etc. I managed to create this view, but I'm not sure if the way I'm calculating it, especially the P90, is correct, you understand?

I'm retrieving the time series and the 90th percentile at the beginning, right? I'm already performing a scalar calculation, so in this case, I already have the 90th percentile value for each service, correct?

timeseries
{
  latency.p90 = percentile(dt.service.request.response_time, 90, scalar: true)
},by: {dt.entity.service,endpoint.name}

But I need to summarize this to show the consolidated p90 of all the services that are part of, for example, the login, right?
The question is, is it correct to calculate another 90th percentile in the summarize function? My understanding is that if I do "latency.p90 = percentile(latency.p90,90)", I'll be capturing the p90 percentile from the p90 percentile, since I already have the value captured at the beginning in the timeseries. Is this understanding correct? My biggest doubt is whether the way I'm doing the calculation is appropriate, and if not, what's the best way to display a single value for the p90 service response time, while still allowing filtering by tag?