Hi, The following is my Scenario
I have the following 3 different searches as follows
search 1 :- index="htc" sessionId="*cap" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as sessionId
search 2 :- index="htc" sessionId="*com" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as sessionId
search 3 :- index="htc" sessionId="*mob" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as sessionId
Now I want to display all the stats count in a Dashboard with different columns like count of search 1 as "cap" , search 2 as "com" and search 3 as "mob"
If you can observe all the searches are same except for the sessionid ending string.
I had already written the following search but it was taking too much time and also not working for hourly time chart view. Could anyone modify the search?
index="htc" sessionId="*cap" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as Cap | appendcols [search index="htc" sessionId="*com" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as Commerce ] | appendcols [search index="htc" sessionId="*mob" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as Mobile ]
Thanks in Advance
This looks a good use of the case
operator.
index=htc sessionId=*cap OR sessionId=*com OR sessionId=*mob | eval report_key = case(match(sessionId,"cap"),"Cap",match(sessionId,"com"),"Commerce",match(sessionId,"mob"),"Mobile",1=1,"Unknown") | stats values(host) as hosts dc(host) as hostcount values(source) as sources by report_key | where hostcount > 1
Note that the final expression in the case
statement is 1=1
: this is a generic "catch all" for anything that doesn't match the other three conditions.
This looks a good use of the case
operator.
index=htc sessionId=*cap OR sessionId=*com OR sessionId=*mob | eval report_key = case(match(sessionId,"cap"),"Cap",match(sessionId,"com"),"Commerce",match(sessionId,"mob"),"Mobile",1=1,"Unknown") | stats values(host) as hosts dc(host) as hostcount values(source) as sources by report_key | where hostcount > 1
Note that the final expression in the case
statement is 1=1
: this is a generic "catch all" for anything that doesn't match the other three conditions.