Chart showing the results of multiple searches

[andilee]

Hi there! Wondering if anyone can offer some advice on how to combine several searches to create a chart...

I have eight searches which show acceptable and unacceptable outcomes for product orders - an order is OK if certain products are ordered together and not OK if one of the products is left out.

They look a bit like:

index=prodmon source="Orders"
| search (P1_FLAG ="Y", P2_FLAG ="N", P3_FLAG ="Y")
| stats count as "Non-compliant Orders: Combo 1"

index=prodmon source="Orders"
| search (P1_FLAG ="Y", P2_FLAG ="Y", P3_FLAG ="Y")
| stats count as "Compliant Orders: Combo 1"

I'm trying to get a chart that will show a count for each possible outcome:

Non-compliant orders: Combo 1 Compliant Orders: Combo 1 etc

Any ideas? I've been mucking around with rename and as to get a new field for each count to combine into a search, but nothing has really worked out so far...

Thanks in advance,
Andrea :

[gauldridge]

Try using two case statements. The first case will identify the combo numbers based on the products that need to be purchased together. The second case checks to make sure that all products were indeed purchased. If all products were purchased, the order is marked compliant. Anything other than "fully compliant" is marked as non-compliant:

The main search piepline:

index="prodmon" source="Orders" 

Defining the product combinations (I've added one that may not exist just to show a larger case statement):

| eval combo_number=case((isnotnull(P1_FLAG) AND isnotnull(P2_FLAG) AND isnotnull(P3_FLAG)),1,(isnotnull(P4_FLAG) AND isnotnull(P5_FLAG) AND isnotnull(P6_FLAG)),2) 

Checking for comliance/non-compliance:

| eval compliance=case((combo_number==1 AND (P1_FLAG=="Y" AND P2_FLAG=="Y" AND P3_FLAG=="Y")),"Compliant Orders: Combo 1",(combo_number==1 AND 1==1),"Non-compliant Orders: Combo 1",(combo_number==2 AND (P4_FLAG=="Y" AND P5_FLAG=="Y" AND P6_FLAG=="Y")),"Compliant Orders: Combo 2",(combo_number==2 AND 1==1),"Non-compliant Orders: Combo 2") 

Getting the counts:

| stats c by compliance

This should get you what you want without having to specifically define every possible combination of flags for every product combo. You only have to define what constitutes a compliant combo. The 1==1 takes care of anything that isn't compliant.

[andilee]

Thanks for the input!! It's not quite returning what I want, but I think I can fine tune this - certainly far more successful than my half-baked faffing about with renames and as.