How to build a logic to create a dashboard with out using the non-transform command.

Hemnaath — Tue, 08 Sep 2020 15:57:29 GMT

Hi All, I have created a dashboard with four panels and used a base query and sub query. But in the base query i have used the non-transforming command.

Base query details

index=test sourcetype=x_service component=x_component | eval result=case(result="Passed","CompletePassed",result="Failed","CompletedFailed",isnotnull(result),result,isnull(result),null) | eventstats lastest(result) as result latest(status) as finalStatus earliest(_time) as Earliest latest(_time) as Latest by transId,component | eval Final_result=case(isnull(result) AND isnotnull(finalStatus),finalStatus,isnotnull(result),result,isnull(result) AND isnull(finalStatus),"MissingStatus") | fields _time, transId,component,result,Final_result,status,finalStatus,message,duration

In one of the panels I have used sub query to find the average duration to complete the transaction.

Average duration to complete the transaction

| timechart span=30m avg(duration)

Using the above base query and sub query, I am able to get the output but it seems it is not best practice to use the non-transforming commands in dashboards, so used stats command instead of event stats command in base search and got the output.

Similarly to calculate the average duration to complete the transaction created another base query for that panel and used the stats/timechart unable to get the output.

index=test sourcetype=x_service component=x_component | stats earliest (_time) as Earliest latest(_time) as Latest by correlationId | eval duration= Earliest-Latest | timechart span=30m avg(duration)

unable to get the output.

But when we use the eventstats commands I am getting the output.

index=test sourcetype=x_service component=x_component | eventstats earliest (_time) as Earliest latest(_time) as Latest by correlationId | eval duration= Earliest-Latest | timechart span=30m avg(duration)

Question is how to write the sub query using the base query.

Thanks in advance.

Re: How to build a logic to create a dashboard with out using the non-transform command.

isoutamo — Tue, 08 Sep 2020 18:56:09 GMT

Hi
Add to the end of base query | fields * if you cannot use transforming commands. Usually this helps to use any fields on sub query. And remember the max amount of event when you are using non transforming query!
R. Ismo

topic How to build a logic to create a dashboard with out using the non-transform command. in Dashboards & Visualizations

How to build a logic to create a dashboard with out using the non-transform command.

Re: How to build a logic to create a dashboard with out using the non-transform command.