Here is example query..
index=A host=host1 | stats count by host
| index=B sourcetype=s1 | dedup host | table host
| index=C sourcetype=s2 | dedup host | table host
| outputcsv output_file_name
Individually, these queries work, but in a perfect world I'd like to run the queries as one to produce the outputs into one single CSV. Possible? Running the searches separately and appending to same CSV file is fine also.
how about using append
index=A host=host1 | stats count by host
|append [ search index=B sourcetype=s1 | dedup host | table host ]
|append [ search index=C sourcetype=s2 | dedup host | table host ]
| outputcsv output_file_name
how about using append
index=A host=host1 | stats count by host
|append [ search index=B sourcetype=s1 | dedup host | table host ]
|append [ search index=C sourcetype=s2 | dedup host | table host ]
| outputcsv output_file_name
Thank you for the suggestion, wow that works!
Try these
(index=A host=host1) OR (index=B sourcetype=s1) OR (index=C sourcetype=s2)
| stats count by host | outputcsv output_file_name
If you don't want count field for index=B and index=C, try this
(index=A host=host1) OR (index=B sourcetype=s1) OR (index=C sourcetype=s2)
| stats count by host | eval count=if(host="host1",count,null())| outputcsv output_file_name
Thank you for the suggestion, you are correct with your 2nd suggestion I didn't want to count them and I find the append command easier to work with. Thanks again, totally forgot that OR will do it as well. Thanks again!