Hi, I want to display this query in my dashboard in two different charts.
So this is my base search query:
host=NETWEBA* sourcetype=iis NOT("ErrorGuid") (sc_status="2**" OR sc_status="3**") "GET" | rex field=cs_referer "https:\/\/[a-zA-Z]+\.[a-zA-Z]+\.([a-zA-Z]+|[a-zA-Z]+.[a-zA-Z]+)\/order20\/order\/confirmation-v2\/(?<orderID>[0-9]+)(.*)" | dedup orderID |stats count by cs_host
Then I want to display this in a different timechart:
timechart span=1h count(orderID) as Number_of_Orders
I tried changing it to eventstats but it didn't work?
You have your search tags reversed. The base search should use
id="OrderSearch" and the post-processing search should use
That said, the
timesearch fails because it needs _time and orderID fields, neither of which come out of the base search because
stats filters fields to those explicitly mentioned.
eventstats should fix that once the fix above is implemented.
Hi, I've swapped the base search and post-processing search and changed it to eventstats but then the base search will not display a chart since we can pick the visualization for stats but not eventstats?
Basically, I need the base query to display a pie chart from stats count by cs_host and the post search query to display a timechart. Timechart span=1h count(orderID) as NumberofOrders