Realtime Combined Search

[aaronkorn]

What is the best way to combine two different searches with results that can be used in a realtime dashboard? We used appendcols but found out that you cannot use it with realtime.

We have this search right now but how would be transform it to be realtime compatable?

index=os source=cpu host=x38dev10 | multikv fields | timechart span=30s avg(pctUser) as User, avg(pctSystem) as System | appendcols [search index="os" sourcetype="ps" host=x38dev10 | multikv fields pctCPU, COMMAND, USER | search USER=redis OR tomcat | eval process=USER."/".COMMAND | timechart span=30s avg(pctCPU) by process useother="f"]

Thanks!

[martin_mueller · Accepted solution]

In general, every subsearch finishes before the main search starts. Real-time searches do not finish, hence subsearches cannot be real-time.

I see you have one timechart without a by field, and one timechart with by process, so I'm assuming your end result columns look something like this?

_time User System process1 process2 process3 process4

?

If that's the case you should be able to combine your two searches using OR:

index=o host=x38dev10 (source=cpu OR sourcetype=ps)

Then do field extractions, filtering, eval, whatnot, and give your cpu source a process:

... | eval process=if(source=cpu, "CPU", process)

And throw it all into one timechart by process.