How to present three different search stats in one single dashboard?

[pavanae]

Hi, The following is my Scenario

I have the following 3 different searches as follows

search 1 :- index="htc" sessionId="*cap" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as sessionId

search 2 :- index="htc" sessionId="*com" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as sessionId

search 3 :- index="htc" sessionId="*mob" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as sessionId

Now I want to display all the stats count in a Dashboard with different columns like count of search 1 as "cap" , search 2 as "com" and search 3 as "mob"

If you can observe all the searches are same except for the sessionid ending string.

I had already written the following search but it was taking too much time and also not working for hourly time chart view. Could anyone modify the search?

index="htc" sessionId="*cap" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as Cap | appendcols [search index="htc" sessionId="*com" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as Commerce ] | appendcols [search index="htc" sessionId="*mob" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount > 1 | stats count as Mobile ]

Thanks in Advance

[alacercogitatus · Accepted solution]

This looks a good use of the case operator.

index=htc sessionId=*cap OR sessionId=*com OR sessionId=*mob | eval report_key = case(match(sessionId,"cap"),"Cap",match(sessionId,"com"),"Commerce",match(sessionId,"mob"),"Mobile",1=1,"Unknown") | stats values(host) as hosts dc(host) as hostcount values(source) as sources by report_key | where hostcount > 1

Note that the final expression in the case statement is 1=1: this is a generic "catch all" for anything that doesn't match the other three conditions.