with the first event "input param"- I am trying to fetch different entity say material/supplied material
with the 2nd event "sqs sent count"-getting the total sqs sent count for that particular material or supplied material
with the 3rd event "total message published to SQS successfully"-getting the count of total message published.
Now i want then to publish in a single row for all those count displayed in table for a single objectype to get in one dashboard panel
Then do a total counts for each columns and displays as a single row which will display in other panel of dashboard
Hi @gcusello @ITWhisperer
I have same source and index for below two events
first event:
{ [-]
awsRequestId:
hostname:
level: 30
msg: data retrieved for Ids
name:
pid: 8
time:
uniqueRetrievedIds: [ [-
275649
]
v: 0
}
second event:
{ [-]
awsRequestId:
hostname:
level: 30
msg: unique objectIds
name:
pid: 8
time:
uniqObjectIds: [ [-]
275649
]
uniqObjectIdsCount: 1
v: 0
}
There is no common key in these two events,but want to have in table view
1.Currently uniqObjectIds,uniqueRetrievedIds are displayed in two rows in a table view,wanted as a single row
2.How to combine multiple event in a single query if there is no common key
.
index= "" source IN ("") "uniqObjectIds" OR "data retrieved for Ids"
| spath output=uniqObjectIds path=uniqObjectIds{} | spath output=uniqueRetrievedIds path=uniqueRetrievedIds{} | eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | eval split_field= split(_raw, "Z\"}") | mvexpand split_field | rex field=split_field "objectIdsCount=(?<objectIdsCount>[^,]+)" | rex field=split_field "uniqObjectIdsCount=(?<uniqObjectIdsCount>[^,]+)" | rex field=split_field "recordsCount=(?<recordsCount>[^,]+)" | rex field=split_field "sqsSentCount=(?<sqsSentCount>[^,]+)" | table_time,PST_TIME,objectType,objectIdsCount,uniqObjectIdsCount,recordsCount,sqsSentCount,uniqObjectIds,uniqueRetrievedIds | sort _time desc
