Use the Derived Column examples below when creating a Derived Column. The specific attributes in each example may or may not exist in your data and environment.
Each example contains:
Most of the example Queries use the three VISUALIZE
, WHERE
, and GROUP BY
clauses, located at the top of the Query Builder display.
VISUALIZE
- Performs a calculation and displays a corresponding graph over time. Most VISUALIZE
queries return a line graph while the HEATMAP
visualization shows the distribution of data over timeWHERE
- Filters based on attribute parameter(s)GROUP BY
- Groups fields by attribute parameter(s)Determine the percentage of successful requests by using a Derived Column.
Create a Derived Column and enter the following function in the Derived Column Editor:
# Count a successful result as 1 and an error as 0.
# Then multiply by 100 to get a percentage
MUL(
IF(
EQUALS(
$status_code,
"200"
),
1,
0
),
100
)
To get the success rate, use the Derived Column name in a query, such as success-rate-derived-column
:
VISUALIZE |
---|
AVG(success-rate-derived-column) |
Monitor the health of a pipeline-style process by using a Derived Column that tells the number of requests that failed to complete.
Create a Derived Column and enter the following function in the Derived Column Editor:
# Assign pipeline-step-1 events a value of 1 and the pipeline-step-2 events a value of -1.
IF(
EQUALS(
$name,
"pipeline-step-1"
),
1,
IF(
EQUALS(
$name,
"pipeline-step-2"
),
-1,
0
)
)
To determine the volume difference between events from the two pipeline steps, use the Derived Column name in a query, such as failed-pipeline-step-derived-column
:
VISUALIZE |
---|
SUM(failed-pipeline-step-derived-column) |
If there are an equal number of pipeline-step-1
events as pipeline-step-2
events, then the SUM
will be zero.
When there are fewer pipeline-step-2
events than pipeline-step-1
events, then the SUM
will be a positive integer.
Find traces with missing root spans by creating a Derived Column and entering the following function in the Derived Column Editor:
# If trace.parent_id exists, then assign a value of 0, else assign a value of 1
IF(
EXISTS(
$trace.parent_id
),
0,
1
)
To find traces with a missing root span, use the Derived Column name in a query, such as check-trace-parent-derived-column
:
VISUALIZE | GROUP BY | HAVING |
---|---|---|
SUM(check-trace-parent-derived-column) | trace.trace_id | SUM(check-trace-parent-derived-column) = 0 |
The sum will return at least 1
if you have a root span and 0
if you have no root span.
To visualize Kubernetes deployment metrics, create a Derived Column and enter the following function in the Derived Column Editor:
REG_VALUE(
$k8s.pod.name,
`(.*)-.*-.*`
)
To visualize Kubernetes deployment metrics, use the Derived Column name in a query, such as k8s.deploy.name.derived.column
:
VISUALIZE | WHERE | GROUP BY |
---|---|---|
MAX(metrics.memory.usage) |
k8s.namespace.name = your-namespace-name | k8s.deploy.name.derived.column |
Any other metric operations can be used instead of VISUALIZE MAX()
in this query example.
For front end developers, compare window sizes to screen sizes using a Derived Column.
Create a Derived Column and enter the following function in the Derived Column Editor:
DIV(
MUL(
$window_height,
$window_width
),
MUL(
$screen_height,
$screen_width
)
)
To compare window sizes to screen sizes, use the Derived Column name in a query, such as screen-used-derived-column
:
VISUALIZE | WHERE |
---|---|
HEATMAP(screen-used-derived-column) | screen-used-derived-column < 1 |
After running the query, if most of the data in the heatmap clusters in a band closer to the top of the display, then most users are already using the majority of their screens.
Group, or bucket, incoming data by content size using a Derived Column.
Create a Derived Column and enter the following function in the Derived Column Editor:
IF(
LT(
$headers.Content-Length,
1000
),
"0:bytes",
IF(
LT(
$headers.Content-Length,
1000000
),
"1:kbytes",
IF(
LT(
$headers.Content-Length,
1000000000
),
"2:mbytes",
"3:huge"
)
)
)
To group incoming data by content size, use the Derived Column name in a query, such as content-length-bucket-derived-column
:
VISUALIZE | GROUP BY |
---|---|
COUNT | content-length-bucket-derived-column |
This query can help answer questions about whether larger file uploads fail more often, and give a general idea of the distribution of file sizes across uploads.
Alternatively:
VISUALIZE | GROUP BY |
---|---|
COUNT |
content-length-bucket-derived-column |
This query can help answer questions about whether larger file uploads fail more often, and give a general idea of the distribution of file sizes across uploads.
Derive the browser version from the user-agent header by using a Derived Column.
Create a Derived Column and enter the following function in the Derived Column Editor:
COALESCE(
IF(
REG_MATCH(
$request.header.user_agent,
"Gecko/"
),
"Firefox"
),
IF(
OR(
REG_MATCH(
$request.header.user_agent,
"Chrome/"
),
REG_MATCH(
$request.header.user_agent,
"Chromium/"
)
),
"Chrome"
),
IF(
REG_MATCH(
$request.header.user_agent,
"AppleWebKit/"
),
"Webkit"
),
IF(
REG_MATCH(
$request.header.user_agent,
"Trident/"
),
"IE"
),
IF(
REG_MATCH(
$request.header.user_agent,
"Edge/"
),
"Edge"
),
"Unknown"
)
To derive the browser versions in use, use the Derived Column name in a query, such as browser-version-derived-column
:
VISUALIZE | GROUP BY |
---|---|
COUNT |
browser-version-derived-column |
This query can help you answer questions about whether requests from particular browser types are failing more frequently.
Derive the browser name from the user-agent header by using a Derived Column.
Create a Derived Column and enter the following function in the Derived Column Editor:
COALESCE(
IF(
REG_MATCH(
$request.header.user_agent,
"Gecko/"
),
"Firefox"
),
IF(
OR(
REG_MATCH(
$request.header.user_agent,
"Chrome/"
),
REG_MATCH(
$request.header.user_agent,
"Chromium/"
)
),
"Chrome"
),
IF(
REG_MATCH(
$request.header.user_agent,
"AppleWebKit/"
),
"Webkit"
),
IF(
REG_MATCH(
$request.header.user_agent,
"Trident/"
),
"IE"
),
IF(
REG_MATCH(
$request.header.user_agent,
"Edge/"
),
"Edge"
),
"Unknown"
)
To derive the browser names in use, use the Derived Column name in a query, such as browser-name-derived-column
:
VISUALIZE | GROUP BY |
---|---|
COUNT |
browser-name-derived-column |
This query can help you answer questions about whether requests from particular browser types are failing more frequently.
Derive the browser operating system (OS) from the user-agent header by using a Derived Column.
Create a Derived Column and enter the following function in the Derived Column Editor:
IF(
CONTAINS(
$request.header.user_agent,
"Macintosh"
),
"Macintosh",
IF(
CONTAINS(
$request.header.user_agent,
"Windows"
),
"Windows",
IF(
CONTAINS(
$request.header.user_agent,
"Android"
),
"Android",
IF(
CONTAINS(
$request.header.user_agent,
"CrOS"
),
"ChromeOS",
IF(
REG_MATCH(
$request.header.user_agent,
"iPhone|iPad"
),
"iOS",
IF(
CONTAINS(
$request.header.user_agent,
"Linux"
),
"Linux",
"Unknown"
)
)
)
)
)
)
To derive the browser operating systems in use, use the Derived Column name in a query, such as browser-os-derived-column
:
VISUALIZE | GROUP BY |
---|---|
COUNT |
browser-os-derived-column |
This query can help you answer questions about whether requests from particular browser types are failing more frequently.
Derive browser architecture from the user-agent header by using a Derived Column.
Create a Derived Column and enter the following function in the Derived Column Editor:
IF(
REG_MATCH(
$request.header.user_agent,
"x86|Intel"
),
"Intel",
IF(
REG_MATCH(
$request.header.user_agent,
"aarch64|armv|Android"
),
"arm",
"unknown"
)
)
This Derived Column example assumes that Android has Arm architecture.
To derive the browser architecture in use, use the Derived Column name in a query, such as browser-architecture-derived-column
:
VISUALIZE | GROUP BY |
---|---|
COUNT |
browser-architecture-derived-column |
This query can help you answer questions about whether requests from particular browser types are failing more frequently.
Did you find what you were looking for?