Let's break down the search piece by piece:
|
Search fragment |
Description |
index=main sourcetype=access_combined |
You should be familiar with this search from the earlier recipes in this chapter. It is used to return events from the website access log. |
| table _time response |
Using the table command, we simplify the dataset into a tabulated view of the _time of the event and the value of the response field for the given event. |
| streamstats window=150 current=true median("response") as median |
Using the streamstats command, we calculate the median value of response using a sliding window value of 150. This effectively calculates the running total for the response field for every event processed. |
| eval ... |
