makeTimeseries for error rate calculated from fetching spans

[virdavindersing]

Below Is the query to fetch spans and calculate error rate

fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") AND matchesValue(k8s.namespace.name, $Tenant) AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) AND (matchesPhrase(endpoint.name, "/wasp/api"))
| summarize all=count(), by:{dt.entity.kubernetes_cluster, start_time}
| join [fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) AND (matchesPhrase(endpoint.name, "/wasp/api")) AND (http.response.status_code!=200 AND http.response.status_code!=201)
| summarize failed=count(), by:{dt.entity.kubernetes_cluster, start_time}
], kind:leftOuter, prefix:"http.", on:{dt.entity.kubernetes_cluster, start_time}
| fieldsAdd {errorrate = http.failed/all *100}
| fieldsRemove all, http.failed
// | makeTimeseries {avg(errorrate)}, by:{interval:10m}


but I am unable to create a timeseries for error rate from the above query.

please help

[virdavindersing]

changed the DQL to below, getting the trendline now but not sure how to handle null records

fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") AND matchesValue(k8s.namespace.name, $Tenant) AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) AND (matchesPhrase(endpoint.name, "/wasp/api"))
| makeTimeseries all=count(), interval: 1m
| join [fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) AND (matchesPhrase(endpoint.name, "/wasp/api")) AND (http.response.status_code!=200 AND http.response.status_code!=201)
| makeTimeseries failed=count(default: 0),interval: 1m
], kind:leftOuter, prefix:"http.", on:{interval, timeframe}
| fieldsAdd {errorrate = http.failed[]/all[] *100}
| fieldsRemove all, http.failed
| fieldsAdd rate = arrayAvg(errorrate)

[krzysztof_hoja · Accepted solution]

It can be achieved with much simpler query:

fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") 
  AND matchesValue(k8s.namespace.name, $Tenant) 
  AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) 
  AND (matchesPhrase(endpoint.name, "/wasp/api"))
| makeTimeseries { all=count(), http.failed=countif(http.response.status_code!=200 AND http.response.status_code!=201) }, interval:10m
| fields errorrate=100*http.failed[]/all[], interval, timeframe

and if you want to have breakdown by k8s cluster, just add:

fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") 
  AND matchesValue(k8s.namespace.name, $Tenant) 
  AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) 
  AND (matchesPhrase(endpoint.name, "/wasp/api"))
| makeTimeseries { all=count(), http.failed=countif(http.response.status_code!=200 AND http.response.status_code!=201) }, interval:10m
 , by: {dt.entity.kubernetes_cluster}
| fields errorrate=100*http.failed[]/all[], interval, timeframe, dt.entity.kubernetes_cluster

[virdavindersing]

thanks for your reply