Append eval'd streamstats to stats in table

[jspigler2010]

I am trying to append and eval'd field from streamstats to other fields from a stats command within a table. The following produces results in each field except new_loss (the eval'd field from streamstats). Is this possible? My current search which doesn't work

index=vdi sourcetype="vmware_pcoip" host=*
| sort _time
| convert ctime(_time) as "Latest Time Stamp" 
| stats last("Latest Time Stamp") as "Latest Time Stamp" last(loss_percentage) as loss_percentage last(round_trip_time_ms) as roundtrip last(rto) as rto last(quality) as quality last(avg_rx) as avgRX last(avg_tx) as avgTX by host
| streamstats current=f window=1 global=f last(bw_limit) as old_bw_limit by host
| eval new_loss=if(bw_limit>0,old_bw_limit-bw_limit,0)
| table "Latest Time Stamp" host loss_percentage roundtrip rto quality avgRX avgTX new_loss

[harishalipaka]

Try with

Inner join

[jspigler2010]

Join worked great!

index=vdi sourcetype="vmware_pcoip" host=* bw_limit!=0 earliest=-15m latest=now 
| sort _time
| streamstats window=1 current=f last(bw_limit) as old_bw_limit by host
| eval new_loss=if(bw_limit<old_bw_limit,old_bw_limit-bw_limit,0) 
| join host [search index=vdi sourcetype="vmware_pcoip" host=* earliest=-15m latest=now 
| convert ctime(_time) as "Latest Time Stamp" 
| stats last("Latest Time Stamp") as "Latest Time Stamp" last(loss_percentage) as loss_percentage last(round_trip_time_ms) as roundtrip last(rto) as rto last(quality) as quality last(avg_rx) as avgRX last(avg_tx) as avgTX last(bw_limit) as bw_limit by host 
| fillnull value="0" 
| where (loss_percentage>=$lossPercentage$) AND (rto>=$rto$) AND (roundtrip>=$roundtrip$) AND (quality>=$quality$) AND (avgTX>=$avgTX$) AND (avgRX>=$avgRX$) AND (bw_limit>=$bw_limit$) ]
| where new_loss>=$new_loss$
| table "Latest Time Stamp" host loss_percentage roundtrip rto quality avgRX avgTX bw_limit

Thanks for the suggestion harish!

[micahkemp]

If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.

[jspigler2010]

Thanks Harish, will try join and see what I get.

[HiroshiSatoh · Accepted solution]

bw_limit does not exist. Please also add bw_limit to STATS.

[micahkemp]

Your search didn’t paste correctly. Please use the code button (101010) to make it format properly.

[jspigler2010]

Micah, not sure what you are referring to?

[jspigler2010]

Nm

Will update using code button...