Getting Data In

subtract value on Subquery


So basically I want to make a subquery where I can use the values founded in the first query to make a subtract from the second subquery


so the idea is get the subquery sum all times for traceId and then subtract the external_time

Any idea how to accomplish this?

sourcetype="serviceppe" source="/var/log/httpClient*.log" | stats sum(timems) as externalresponse by traceid | join externalresponse [search sourcetype="serviceppe" source="/var/log/request*.log" | stats sum(timems) as response by traceid | eval priceresponse=(response - externalresponse) | timechart count(price_response) ]


0 Karma


The following search may be closer to what you want. However, you can't have a timechart at the end of this pipeline, because you have factored out _time in the stats commands. And you don't need a subsearch.

sourcetype="service_ppe" source="/var/log/httpClient*.log" OR source="/var/log/request*.log"
| eval type=if(match(source,"/var/log/request.*.log"),"response","external_response")
| chart sum(time_ms) by trace_id type
| eval price_response=response - external_response

For each traceid, this calculates the sum of the timems. If the timems comes from the httpClient log, it is added to the externalresponse. If the timems comes from the request log, it is added to the response. Finally, the difference between the two is calculated for each traceid. The resulting table will show the traceid, externalresponse, response, and price_response.

If you want a timechart, exactly what do you want to see on the chart?