I have 2 search strings that I am trying to combine to put on one dashboard.
sourcetype=snmp_ta host=* | eval fuel=case(ppscFuelLevel > 10000, 0, 1=1, ppscFuelLevel), FuelPct = fuel/100 | stats latest(FuelPct)
and
sourcetype=snmp_ta host=* | eval fuel=case(fuelLevel > 10000, 0, 1=1, fuelLevel), FuelPct = fuel/100 | stats latest(FuelPct)
These strings are from different generators both reporting fuel levels.
Can you help?
Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)
In final output, do you want to two columns, showing FuelPct for different criteria?
Try using coalesce, like so:
sourcetype=snmp_ta host=*
| eval myFuelLevel = coalesce(ppscFuelLevel, fuelLevel)
| eval fuel=case(myFuelLevel > 10000, 0, 1=1, myFuelLevel), FuelPct = fuel/100
| stats latest(FuelPct)
Thank You, I have the Fuel Percentage reporting on a Fuel Gauge to monitor the Fuel. It is working now so that I can combine 2 dashboards into one.
No problem, glad to help.
FWIW, you can also replace the case function with an if: fuel=if(myFuelLevel > 10000, 0, myFuelLevel)
since you only have one condition.