I have logs where I want to count multiple values for a single field as "start" and other various values as "end". How would I go about this? I want to be able to show two rows or columns where I show the total number of start and end values.
index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval start = my_field=1 OR my_field=2 OR my_field=3
| eval end = my_field=4 OR my_field=5 OR my_field=6
| stats count by start end
I ended up using case
index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval status=case(my_field=1 "start", my_field=2 "start", my_field=3 "start", my_field=4 "end", my_field=5 "end", my_field=6 "end")
| stats count by status
I ended up using case
index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval status=case(my_field=1 "start", my_field=2 "start", my_field=3 "start", my_field=4 "end", my_field=5 "end", my_field=6 "end")
| stats count by status
That would be the way to go. A minor cosmetic change (clubbing multiple conditions together, adding else/default forrest of values/conditions):
index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval status=case(my_field=1 OR my_field=2 OR my_field=3, "start", true(), "end")
| stats count by status
You could use "in" function to check the static value list to the above query:
index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval status=case(in(my_field,1,2,3),"Start",in(my_field,4,5,6),"End",1==1,NULL)
| stats count by status