I'm working with dashboards and the goal is to show a bar graph panel that displays the counts for two different fields separately
(2 bars per timespan) if possible.
The data is from the same index...the actions field(action=blocked) and category field (category=221)
I can build a visual for each individual field but having trouble combining the two.
index=url_filter action=blocked login_id="$user$"|stats count by _time |bucket _time span=1h
I have another field not exclusive to field [action=blocked] that id like to display as well.
Any tips appreciated.
Like this:
index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| bucket _time span=1h
| stats count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221 BY _time
OR
index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| timechart span=1h count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221
sorry for leaving it out but a sample search for category would have been
index=url_filter category=221 login_id="$user$"|stats count by _time |bucket _time span=1h
these answers have definitely put me on the right track with the eval
Do the bucket
earlier. See my answer.
Try like this (assuming calculation of count independently for both conditions). You didn't provide a query for calculation of category=221, I'm just using filter based on field category, adjust the query per yours)
index=url_filter (action=blocked login_id="$user$") OR (category=221)
| eval CountBlocked=if(action="blocked",1,0) , CountCat221=if(category=221,1,0)
| timechart span=1h sum(CountBlocked) as CountBlocked sum(CountCat221) as CountCat221
Like this:
index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| bucket _time span=1h
| stats count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221 BY _time
OR
index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| timechart span=1h count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221
this solution worked and is simplified, than you both for the answers
Be sure to come back here and click Accept
to close the question and also UpVote
any answers or comments that were useful.