I am trying to turn my columns into rows and I have not had any luck with the xyseries command.
Here is my search:
index=loadtest source="*\\log\\home*" rps data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps | stats avg(data) AS "View"] | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"]
so in the results I get
Home View Offer
58 55 55
And I want to get
Home 58
View 55
Offer 55
Alternative (using existing query)
index=loadtest source="*\\log\\home*" rps data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps | stats avg(data) AS "View"] | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id
Alternative (using existing query)
index=loadtest source="*\\log\\home*" rps data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps | stats avg(data) AS "View"] | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id
Try this:
index=loadtest (source="*\\log\\home*" OR source="*\\log\\view*" OR source="*\\log\\offer*") rps data=* | eval category = case(match(source, "\\log\\home"), "Home", match(source, "\\log\\view"), "View", match(source, "\\log\\offer"), "Offer", 1=1, "Unknown") | stats avg(data) by category
Right. Add backslashes until that goes away... probably needs four each, two get eaten by the string and one by the regex, leaving one to actually match the path separator.
That's what I get for not testing things 😛
I got this
"Error in 'eval' command: Regex: PCRE does not support \L, \l, \N{name}, \U, or \u"