Hi team,
How can I add the below two queries into one single query and present in a single table.
query 1 : index="dev_envi" | chart count(ApplicationName) over ApplicationName by Status |addtotals
Result : app1 5
app2 8
query 2 : index="dev_envi" | chart count(event.ApplicationName) over event.ApplicationName by event.Status |addtotals
Result : app1 3
app2 6
Now I need a single query to add above both values and display in Dashboard like below (adding above both table data):
app1 8
app2 14
Hi rich,
Thanks for the quick response
For this single query I am getting results as same as below query results.
- index="dev_envi" | chart count(ApplicationName) over ApplicationName by Status |addtotals
and missing the results of the query - index="dev_envi" | chart count(event.ApplicationName) over event.ApplicationName by event.Status |addtotals
Can you share some sample events of both types. please?
See if this helps.
index="dev_envi"
| eval ApplicationName = coalesce(event.ApplicationName, ApplicationName), Status = coalesce(event.Status, Status)
| chart count(ApplicationName) as count over ApplicationName by Status
| addtotals
Hi rich,
Thanks for the quick response
For this single query I am getting results as same as below query results.
- index="dev_envi" | chart count(ApplicationName) over ApplicationName by Status |addtotals
and missing the results of the query - index="dev_envi" | chart count(event.ApplicationName) over event.ApplicationName by event.Status |addtotals