There are two result sets , How can I get the results of merging? and how does command (join) use?
hello there,
assuming the field names for "project" and "yyyymm" are the same in both data sets, you can use stats
instead of join
in your case, try this:
.... your search ... "find results set 1" OR "find results set 2" ...
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm
here is an example search to run anywhere:
| makeresults count=1
| eval result_set_1 = "201808,cas,100;201808,at,120;201808,srm,2019"
| makemv delim=";" result_set_1
| mvexpand result_set_1
| rex field=result_set_1 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<fee>\d+)"
| append
[ | makeresults count=1
| eval result_set_2 = "201808,cas,1;201808,at,2;201808,srm,10;201808,commonservice,1000"
| makemv delim=";" result_set_2
| mvexpand result_set_2
| rex field=result_set_2 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<vm_count>\d+)" ]
| rename COMMENT as "the above generates data, below is your solution"
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm
screenshot:
hope it helps
hello there,
assuming the field names for "project" and "yyyymm" are the same in both data sets, you can use stats
instead of join
in your case, try this:
.... your search ... "find results set 1" OR "find results set 2" ...
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm
here is an example search to run anywhere:
| makeresults count=1
| eval result_set_1 = "201808,cas,100;201808,at,120;201808,srm,2019"
| makemv delim=";" result_set_1
| mvexpand result_set_1
| rex field=result_set_1 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<fee>\d+)"
| append
[ | makeresults count=1
| eval result_set_2 = "201808,cas,1;201808,at,2;201808,srm,10;201808,commonservice,1000"
| makemv delim=";" result_set_2
| mvexpand result_set_2
| rex field=result_set_2 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<vm_count>\d+)" ]
| rename COMMENT as "the above generates data, below is your solution"
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm
screenshot:
hope it helps