Calculating math on three different searches

[labaningombam]

Hi,

I need to write a query to find the time remaining to consume events.

index=x message.message="Response sent" message.feedId="v1" | stats count as Produced

index=y | spath RenderedMessage | search RenderedMessage="*/v1/xyz*StatusCode*2*"| stats count as Processed

index=z message.feedId="v1" | stats avg("message.durationMs") as AverageResponseTime

So I want to basically perform:
Average Time left = Produced - Processed /AverageResponseTime

How can I go about doing this?

Thank you so much

[labaningombam]

Thank you so much for the correction as well 🙂

This worked. 

[ITWhisperer · Accepted solution]

You could try something like this

index=x message.message="Response sent" message.feedId="v1" | stats count as Produced
| appendcols [ search index=y | spath RenderedMessage | search RenderedMessage="*/v1/xyz*StatusCode*2*"| stats count as Processed]
| appendcols [ search index=z message.feedId="v1" | stats avg("message.durationMs") as AverageResponseTime]
| eval AverageTimeLeft = (Produced - Processed) * AverageResponseTime

Note that I think your calculation should be a multiplication not a division