I am in need of combining these three searches into one search:
1.
NameOfJob = BLT* | spath message | search message = " JOB STARTED" | spath Details | search Details = * | spath timestamp
| search timestamp = *
| stats earliest(timestamp) as StartTime, latest(timestamp) as EndTime by NameofJob Details Description
2.
NameOfJob = BLT* | spath timestamp | search timestamp=*
| stats min(timestamp) as StartTimeEpoch, max(timestamp) as EndTimeEpoch by NameOfJob
| eval StartTimeEpoch=strptime(StartTimeEpoch, "%Y-%m-%dT%H:%M:%S")
| eval EndTimeEpoch=strptime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")
| eval duration=(EndTimeEpoch-StartTimeEpoch) | eval minutes = duration/60 | eval hours = minutes/60
| eval StartTimeEpochD = strftime(StartTimeEpoch,"%Y-%m-%dT%H:%M:%S")
| eval EndTimeEpochD = strftime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")
3.
NameOfJob = BLT* | spath "countOfRecords" | search "countOfRecords"=*| spath timestamp | search timestamp=*
| stats earliest(timestamp) as StartTime , latest(timestamp) as EndTime
by countOfRecords NameOfRecords
I have already created a query that uses join (see below). However, it has very poor performance. The solution I am looking should not have poor performance.
My attempt (using join):
NameOfJob = BLT* | spath message | search message = "JOB STARTED" | spath Details | search Details = * | spath timestamp | search timestamp = *
| stats earliest(timestamp) as StartTime, latest(timestamp) as EndTime by NameOfJob Details Description
| join type=outer NameOfJob
[search NameOfJob = BLT* | spath timestamp | search timestamp=*
| stats min(timestamp) as StartTimeEpoch, max(timestamp) as EndTimeEpoch by NameOfJob
| join type=outer NameOfJob
[search NameOfJob = BLT* | spath "countOfRecords" | search "countOfRecords"=*| spath timestamp | search timestamp=*
| stats earliest(timestamp) as StartTime , latest(timestamp) as EndTime
by countOfRecords NameOfJob]
| eval StartTimeEpoch=strptime(StartTimeEpoch, "%Y-%m-%dT%H:%M:%S")
| eval EndTimeEpoch=strptime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")
| eval duration=(EndTimeEpoch-StartTimeEpoch) | eval minutes = duration/60 | eval hours = minutes/60
| eval StartTimeEpochD = strftime(StartTimeEpoch,"%Y-%m-%dT%H:%M:%S")
| eval EndTimeEpochD = strftime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")]
This is all under the same index and source type
Any help is appreciated. Thank you!
Try this
|union
[ your query1]
[ your query2]
[ your query2]
|stats max(*) as * by NameOfJob