Combine similar queries to create summary index

[mukeshchandak]

How can I combine these 3 queries given everything before pipe is same:

query1: index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*|timechart span=1s count

query2: index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*|timechart span=5m eval(count()) as "Response Code" by response_code

query3: index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*| timechart span=5m avg(response_time) as "Avg Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile"

[gcusello]

Hi @mukeshchandak,

you could use the append command to put the three searches in one and collect the results in one, but there's the problem that you have different fields.

You could also schedule three different searches and save results in a summary to quicly have results.

But in my opinion, the best solution is to save results of one simple search in a Summary, then running the searches with timechart in three different panels.

In other words, I'd schedule this search, e.g. every 5 minutes:

index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*
| table _time response_time response_code
| collect index=my_summary

then I'd run the three searches in different dashboard panels:

query1: 
index=my_summary
| timechart span=1s count

query2: 
index=my_summary
| timechart span=5m eval(count()) as "Response Code" by response_code

query3: 
index=my_summary
| timechart span=5m avg(response_time) as "Avg Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile"

Ciao.

Giuseppe