Combine two counts where event2 is a subset of event2

[elaoumam]

Hi there,

I have these two searchs to count TPS :
First one :

index=tutti sourcetype=toto status!=4  | bucket span=1m _time | stats count by _time | stats sum(count) as Rate_per_Minute by _time | eval Rate_per_Second = Rate_per_Minute / 60 | stats max(Rate_per_Second) as Peak_Rate_per_Second by _time | rename _time as Registered_At | fieldformat Registered_At = strftime(Registered_At, "%Y-%m-%d %H:%M:%S") | sort - Peak_Rate_per_Second | head 1

Second one :

index=tutti sourcetype=toto notif=1 AND orig=0 AND status!=9 AND status!=4  | bucket span=1m _time | stats count by _time | stats sum(count) as Rate_per_Minute by _time | eval Rate_per_Second = Rate_per_Minute / 60 | stats max(Rate_per_Second) as Peak_Rate_per_Second by _time | rename _time as Registered_At | fieldformat Registered_At = strftime(Registered_At, "%Y-%m-%d %H:%M:%S") | sort - Peak_Rate_per_Second | head 1

I want to combine both counts to sum their counts per minute before deviding by 60 knowing that event2 is a subset of event1 (like counting it twice).

I don't seem to find a way to do that.

Can ayone please help me on this one ?

Best Regards

[Sukisen1981 · Accepted solution]

something like this

index=tutti sourcetype=toto status!=4|eval event=if(notif=1 AND orig=0 AND status!=9 AND status!=4,"event1","event2")|
bucket span=1m _time | stats count(event) by _time

See the output from the above and then you can re-tweak the rest of your code just a bit

[elaoumam]

Thanks for the answer !
It does work perfectly as expected when tweaking it a bit as follows :
index=tutti sourcetype=toto status!=4 | eval event=if(notif=1 AND orig=0 AND status!=4 AND status!=9,"event2","event1") | bucket span=1m _time | stats count(eval(event="event1")) AS count1, count(eval(event="event2")) AS count2 by _time | eval counts = 2 * count2 + count1 | stats sum(counts) as Rate_per_Minute by _time | eval Rate_per_Second = Rate_per_Minute / 60 | stats max(Rate_per_Second) as Peak_Rate_per_Second by _time | rename _time as Registered_At | fieldformat Registered_At = strftime(Registered_At, "%Y-%m-%d %H:%M:%S") | sort - Peak_Rate_per_Second | head 1

[Sukisen1981]

you have done quite a bit of tweaking 🙂 I was not sure about your exact requirements, but knew that what you are looking for is to split the raw events using an if...great that you figured out the rest!