topic Re: join SingleValue search in Dashboards & Visualizations

join SingleValue search

kris99 — Tue, 30 Sep 2014 03:58:00 GMT

how do I join below two searches and return within same SingleValue with following conditions..

If "ConnectionStatus" is "On" and "Events" is "0" , display "No Errors" with low range
If "ConnectionStatus" is "On" and "Events" is greater than "0" , display "Warning" with elevated range
If "ConnectionStatus" is NOT "On" and "Events" is greater than "0" , display "Error" with severe range

Events
index=yyy sourcetype="Events" Type!=Information (EventCode>="3012" AND EventCode<="3054") | stats count | eval StateBool = if (count==0, 0, 1) | eval Status=if(count==0,"No Errors","Warning") | rangemap field=StateBool low=0-0 elevated=1-1 | table Status range

Re: join SingleValue search

sk314 — Tue, 30 Sep 2014 07:36:30 GMT

If I understand it correctly, this should work:

index=xxx sourcetype="ConnectionStatus" State!="On"| stats count AS connection_off_count | appendcols [ index=yyy sourcetype="Events" Type!=Information (EventCode>="3012" AND EventCode<="3054") | stats count AS event_error_count] | eval warning_type = case( (connection_off_count ==0) AND (event_error_count == 0), "No Errors", (connection_off_count ==0) AND (event_error_count > 0), "Warning", (connection_off_count > 0) AND (event_error_count > 0),"Error") | table warning_type

Re: join SingleValue search

kris99 — Thu, 02 Oct 2014 03:45:55 GMT

Thank you. That works.

But how do I use range / rangemap with that search ?

No Errors is Green Tick , Warning is Orange & Error is Red cross

Re: join SingleValue search

sk314 — Thu, 02 Oct 2014 04:04:01 GMT

you could pipe your rangemap logic before the table command. It should work.