Hi,
Initially I tried with:
ConsumerService HostEnvironmentName=PROD| top limit=10 message
to get the daily details, then to display current rank modified with:
ConsumerService HostEnvironmentName=PROD| top limit=10 message | streamstats count as C.Rank
but I am struggling to get the ranks of top 10 messages for previous day,
Please guide me to right direction.
Abhishek
See if this gives you what you're looking for
index=_internal sourcetype=*web* earliest=-1d@d | top 100 uri | streamstats count as "Yesterday's Rank" | where [ search index=_internal sourcetype=*web* earliest=@d | top 10 uri | table uri] | rename percent as "Yesterday's Percent" | appendcols [ search index=_internal sourcetype=*web* earliest=@d | top 10 uri ] | streamstats count as "Today's Rank" | rename percent as "Today's Percent" | fields - count
See if this gives you what you're looking for
index=_internal sourcetype=*web* earliest=-1d@d | top 100 uri | streamstats count as "Yesterday's Rank" | where [ search index=_internal sourcetype=*web* earliest=@d | top 10 uri | table uri] | rename percent as "Yesterday's Percent" | appendcols [ search index=_internal sourcetype=*web* earliest=@d | top 10 uri ] | streamstats count as "Today's Rank" | rename percent as "Today's Percent" | fields - count
Thanks sundareshr for quick response.
The solution is perfect. I needed error counts also, so I replaced fields - count -> rename count as Count
Thanks again !!