I have a column with response times and when I filter using that column the results are completely wrong
When I filter responseTime > 6
But, when I filter responseTime > 9, I’m only able to see anything that starts with 9. If the list is having 600, it’s not apprearing when I filter it with > 9.
Here is what I have in config
Please include request/response details using query inspector
Here are the request and response details when I filter with 99
{
"xhrStatus": "complete",
"request": {
"method": "POST",
"url": "api/datasources/proxy/3/_msearch",
"data": "{\"search_type\":\"query_then_fetch\",\"ignore_unavailable\":true,\"index\":\"splunk-metrix-*\"}\n{\"size\":9999,\"query\":{\"bool\":{\"filter\":[{\"range\":{\"@timestamp\":{\"gte\":\"1555180200000\",\"lte\":\"1555784999999\",\"format\":\"epoch_millis\"}}},{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},{\"range\":{\"ResponseTimeMillis\":{\"gt\":\"99\"}}}]}},\"sort\":{\"@timestamp\":{\"order\":\"desc\",\"unmapped_type\":\"boolean\"}},\"script_fields\":{},\"docvalue_fields\":[\"@timestamp\"]}\n"
},
"response": {
"responses": [
{
"took": 6,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 2,
"max_score": null,
"hits": [
{
"_score": null,
"_source": {
"ResponseTimeMillis": "9966",
},
]
},
"status": 200
}
],
"$$config": {
"method": "POST",
"url": "api/datasources/proxy/3/_msearch",
"data": "{\"search_type\":\"query_then_fetch\",\"ignore_unavailable\":true,\"index\":\"splunk-metrix-*\"}\n{\"size\":9999,\"query\":{\"bool\":{\"filter\":[{\"range\":{\"@timestamp\":{\"gte\":\"1555180200000\",\"lte\":\"1555784999999\",\"format\":\"epoch_millis\"}}},{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},{\"range\":{\"ResponseTimeMillis\":{\"gt\":\"99\"}}}]}},\"sort\":{\"@timestamp\":{\"order\":\"desc\",\"unmapped_type\":\"boolean\"}},\"script_fields\":{},\"docvalue_fields\":[\"@timestamp\"]}\n"
}
}
}ResponseTimeMillis is stored/returned as a string - there’s your problem.
Thank you. Converted string to a number and the issue is resolved now