Dashboard-Data and search as one query

[nithys]

Hi Team,

Currently in my dashboard i am using two separate query for data and search lambda separetly and added to the dashboard
1.I want a combine query which works for both data and search lambda together an display reult as below

GET /data/v1/amaz	1601
GET /search/v1/amaz	159
GET /data/v1/product	3
GET /search/v1/product	186
GET /data/v1/hack	373
GET /data/v1/cb1	1127
GET /search/v1/hack	297

Data lambda query:

index=np    source IN ("/aws/lambda/p-api-data-test-*") "gemini:streaming:info:*:*:responseTime"
| eval Entity = requestType . "/data/" . entity
| stats 
    sum(responseTime) as totalResponseTime,
    avg(responseTime) as avgResponseTime,
    count as totalTimeBuckets
    by Entity
| eval avgResponseTime = round(avgResponseTime, 2)
| rename totalResponseTime as "totalResponseTime(ms)", avgResponseTime as "avgResponseTime(ms)", totalTimeBuckets as "totalTimeBuckets"
| table Entity "avgResponseTime(ms)" 
| sort - "totalResponseTime(ms)"

Data lambda Event:

{ [-]
   apiResponseTime: 222
   awsRequestId: 
   client: Joshu
   domain: product
   entity: product
   hostname: 
   level: 30
   msg: gemini:streaming:info:product:data:responseTime
  
   pid: 8
   queryParams: { [+]
   }
   requestType: GET
   responseTime: 285
   time: 2025-05-01T21:59:06.588Z
   v: 0
}

Search lambda:

index=np  source="/aws/lambda/p-api-search-test-*" "gemini:streaming:info:*:search:response:time"
| rex field=source "/aws/lambda/pdp-pc-api-search-test-(?<entity>[^/]+)"
| eval Entity = requestType . " search/" . entity
| stats 
    sum(responseTime) as totalResponseTime,
    avg(responseTime) as avgResponseTime,
    count as totalTimeBuckets
    by Entity
| eval avgResponseTime = round(avgResponseTime, 2)
| rename totalResponseTime as "totalResponseTime(ms)", avgResponseTime as "avgResponseTime(ms)", totalTimeBuckets as "totalTimeBuckets"
| table Entity  "avgResponseTime(ms)" 
| sort - "totalResponseTime(ms)"

Search lambda Event:

{ [-]
   apiResponseTime: 146
   client: Joshua.Be
   domain: product
   entity: amaz

   level: 30
   msg: gemini:streaming:info:amaz:search:response:time
 
   pid: 8
   queryHits: 50
   queryParams: { [+]
   }
   requestType: GET
   responseTime: 149056
   time: 2025-05-01T22:01:35.622Z
   v: 0
}

2.Data api msg: will be: gemini:streaming:info:product:data:responseTime
Search api msg: will be: gemini:streaming:info:amaz:search:responseTime
so in query i added keyword as "gemini:streaming:info:*:*:responseTime" but througing error as 
"The term '"gemini:streaming:info:*:*:responseTime"' contains a wildcard in the middle of a word or string. This might cause inconsistent results if the characters that the wildcard represents include punctuation"

[livehybrid]

Hi @nithys 

As @bowesmana mentioned - since you dont have many variances then you should specifically list them in an "IN" within your search.

Then do any evals to align your different events, such as using COALESCE to map different field names into a common fieldname (e.g | eval responseTime=COALESCE(responseTime, response_time))

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[bowesmana]

Why are you using wildcards if they are not necessary. Your data and your comments say the msg values are defined as 

gemini:streaming:info:product:data:responseTime
gemini:streaming:info:amaz:search:response:time

(The data shows a slight difference in responseTime vs. response:time compared to your comment)

Just use this type of search

... msg IN ("gemini:streaming:info:product:data:responseTime","gemini:streaming:info:amaz:search:response:time")