How to compare columns in a row

[ewanbrown]

Hi

I have a query that produces some output like this:

ID server_a.1  server_a.2        server_b.1           server_b.2
1  0                   0            1                       0
2  1                   0            1                       1
3  1                   1            0                       0

I'd like to be able to add to it to tell me the number of ID's which are present in server_a*, but not in server_b* and visa versa. I think I can do it by making this an inner query, however I need to do it across millions of records, so that is not an option

Any help is appreciated!

Thanks

[woodcock]

Append this to your search:

... | foreach server_a* [eval A = A + <<FIELD>>] | foreach server_b* [eval B = B + <<FIELD>>] | multireport | [stats dc(ID) AS dcIDbyA values(ID) AS valuesIDbyA BY A] [stats dc(ID) as dcIDbyB values(ID) AS valuesIDbyB BY B]

[somesoni2]

If the name of servers are fixed/static, then something like this could work

your current search giving above output | addtotals server_a* fieldname=present_in_server_a | addtotals server_b* fieldname=present_in_server_b | eval status=case(present_in_server_a =0 AND present_in_server_b>0 ,"Present in server_b* only", present_in_server_a >0 AND present_in_server_b=0,"Present in server_a* only",1=1,"Present in both")

This will add a field status to specify which ID is present in which servers. You can further chart the count if you need

above search | stats count by status

[ewanbrown]

Perfect, thanks

[lguinn2]

It would be helpful to see the search that produced this.
I have a feeling that this table was produced by a chart command - but by using a stats command then xyseries, I think you can easily get what you want.

[ewanbrown]

Hi,

I've the answer now, but the source query was:

index=beacons| spath | eval       temp=mvzip(mvzip(mvzip('bean.data.matches{}.clusterId','bean.data.matches{}.facility'),'bean.data.matches{}.matchStatus'), 'bean.data.matches{}.cluster') | mvexpand temp | eval x = split(temp,",") | eval clusterId=mvindex(x,0) | eval facility=mvindex(x,1) | eval match_status=mvindex(x,2) | eval cluster=mvindex(x,3) | search cluster=1 OR cluster=2 OR cluster=3 |  chart count by clusterId, facility