Hi ,
Based on your suggestion I prepared queries for two different apps as below. Now I need to combine these two and get a single stats table.
Stats table like as :
jId Applname diff ASNumber - StNumber - count
xy app1 23 983723 2
uw app2 98 377813 1
Query 1:
|rex field=_raw "ApplicationName:\s+\[(?P<Applname>.*)];"
|rex field=_raw "jobId: (?<jId>\w+);"
|rex field=_raw "\<ASNumber\>(?<ASNumber>[^\<]+)\<[^\<]"
|eventstats count(jId) as jIdcount by ASNumber
|where jIdcount > 1
|stats range(_time) as diff, first(ASNumber) as ASNumber, count(ASNumber) as count by jId,Applname
Query 2:
|rex field=_raw "ApplicationName:\s+\[(?P<Applname>.*)];"
|rex field=_raw "jobId: (?<jId>\w+);"
|rex field=_raw "StNumber\":\"(?P<StNumber>.[^\"\,\"]*)"
|eventstats count(jId) as jIdcount by StNumber
|where jIdcount > 1
|stats range(_time) as diff, first(StNumber) as StNumber,count(StNumber) as count by jId,Applname
