How to combine multiple queries into one?

[vintik]

Hello,

I have multiple queries with small differences, is it possible to combine them?

Here is example:

index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName1)  | eval duration=span_duration/1000 | stats p99(duration)

index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName2 OR span_name=SomeSpanName3)  | eval duration=span_duration/1000 | stats p99(duration)

index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName4)  | eval duration=span_duration/1000 | stats p99(duration)

The result of each query is only one column p99(duration) with value.

Is it possible to combine these queries and get a result with three columns with different names (I need to know the correspondence of each column to the condition)?

[HiroshiSatoh]

Try this!

 index=some_index sourcetype=some_source host=*host*  (span_name=SomeSpanName1 OR span_name=SomeSpanName2 OR span_name=SomeSpanName3 OR span_name=SomeSpanName4)
| eval duration=span_duration/1000 | stats p99(duration)  by span_name
| transpose header_field=span_name| fields - column

[harsmarvania57]

Hi @vintik,

Please try below query.

index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName1 OR span_name=SomeSpanName2 OR span_name=SomeSpanName3 OR span_name=SomeSpanName4)
| eval duration=span_duration/1000
| stats p99(eval(if(span_name="SomeSpanName1",duration,0))) AS p99_Span1, p99(eval(if(span_name="SomeSpanName2" OR span_name="SomeSpanName3",duration,0))) AS p99_Span2_3, p99(eval(if(span_name="SomeSpanName4",duration,0))) AS p99_Span4  

I have created run anywhere search as below which gives me correct result.

| makeresults | eval span_name="SomeSpanName1", span_duration="1001"
| append [ makeresults | eval span_name="SomeSpanName2", span_duration="2001" ]
| append [ makeresults | eval span_name="SomeSpanName3", span_duration="3001" ]
| append [ makeresults | eval span_name="SomeSpanName4", span_duration="4001" ]
| eval duration=span_duration/1000
| stats p99(eval(if(span_name="SomeSpanName1",duration,0))) AS p99_Span1, p99(eval(if(span_name="SomeSpanName2" OR span_name="SomeSpanName3",duration,0))) AS p99_Span2_3, p99(eval(if(span_name="SomeSpanName4",duration,0))) AS p99_Span4