How to display the stats count for multiple field values on a dashboard panel where the count is greater than 2 within 1 minute?

[msackett]

I have multiple fields with different values (error messages) from the same log. I am trying to get a count per field, per value. I want this to be displayed if count is >2 in a set time period(1m) in a panel of my dashboard.

index=? Field1=500 OR Field2="Server Error*" OR Field2="TIMEOUT*" OR Field3="authorize" |stats count by Field, Field1, Field2, Field3, Field4, Field5, Field6, |where count>2 

Can anyone help... Thanks

[Richfez · Accepted solution]

I am presuming that you want these events divided into precise 1 minute chunks, regardless of the overall timeframe you've picked for your dashboard, and that you then want the "where" to only include them if for that one minute chunk of time had a count greater than 2. If that's right, then I think you are almost there.

Try add the "bin" command to your search before the stats, then adding your new time-span value to the by clause of your stats, like ...

index=? Field1=500 OR Field2="Server Error*" OR Field2="TIMEOUT*" OR Field3="authorize" 
| bin _time span=1m as minute 
| stats count by Field, Field1, Field2, Field3, Field4, Field5, Field6, minute
| where count>2

Give that a shot and see where it gets you.

A couple of notes:
1) If you don't want to see "minute" you can always remove it with ... | fields - minute ... once you are done with it (after stats).
2) This may only work for non-insane time-frames. If your dashboard is set to do a 6 month period, I'm not sure you can do a 1m bin there, at least not quickly. 🙂

[msackett]

Thank you. That worked..