How can I combine stats from multiple servers from 1 site as 1 row to build a stats table for multiple sites?

[sligerc]

I've got to get a report going that will show us multiple cloud site statistics for XenDesktop in a single report. What makes this a challenge is if I use sum() it adds all stats within the search time, and since the script reports in multiple times an hour, the stats would then be off...big time. So ideally I would like to avg() the stats from both Site servers, then add them together to form the Site table. Here's what I have so far:

This search:

index=CitrixXenDesktop source=XenDesktop:Get-XDDesktopGroup7.ps1 sourcetype=XenDesktop:desktopgroup
| eval DesktopsOff = TotalDesktops-(DesktopsUnregistered+DesktopsAvailable+DesktopsDisconnected+DesktopsInUse)
| stats max(DesktopsAvailable) as Available max(DesktopsInUse) as InUse max(DesktopsDisconnected) as Disconnected max(DesktopsUnregistered) as Unregistered max(DesktopsOff) as Off by host

…gives these results:

![

This is close, but I need to add the stats for each Site server and get something like this:

[richgalloway]

If you have a way to get the site names from the host names then you could change the stats command to by site instead of by host and have your desired results. A simplistic example would be:

index=CitrixXenDesktop source=XenDesktop:Get-XDDesktopGroup7.ps1 sourcetype=XenDesktop:desktopgroup
| eval DesktopsOff = TotalDesktops-(DesktopsUnregistered+DesktopsAvailable+DesktopsDisconnected+DesktopsInUse)
| eval site=substr(host,1,5) |
| stats max(DesktopsAvailable) as Available max(DesktopsInUse) as InUse max(DesktopsDisconnected) as Disconnected    max(DesktopsUnregistered) as Unregistered max(DesktopsOff) as Off by site

[sundareshr]

Append this to the end of your search. You may have to tweak the regex to match your data. But the idea is to extract the site name from host field and group sum by site.

... | rex field=Host "(?<Site>Site\d+)" | stats sum(*) as * by Site