I have been trying to work this out for a while now. Unfortunatly without any success:
I have a lookup table that consists of two columns - metricname and metricfunction.
At the moment it looks like this:
Event Count sum(count)
CPU consumption sum(cpu)
Mem consumption sum(mem)
These fields are used to dynamically populate PullDown menus that show the metricname as label and set the value to metricfunction. These Pulldowns are then used to generate certain charts. Moreover, I want to create a table that lists program names and ALL of the above metrics. The problem is, I cannot hardcode this table (aka stats command) because the above lookup table can be extended by more metrics.
My question is: how do I generate a search query dynamicall that gives me the following result | stats sum(count) sum(cpu) sum(mem) ....
Has anyone any experience with this?
I have already tried the format and fieldformat commands, but without success...
A hint in the right direction would really be appreciated 🙂
I have figured out a way to create the search string after the stats command like this:
the bold printed part is the actual sequence generation, the italic part of the query is the base search, so to speak, where I'm only interested in n, the number of my applications, i.e. the number of categories that I have to stack.