Hello
I use 2 separate search almost identical
Now I want to merge these 2 search in one search
Here is the search
index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h
| fields citrtt s
| bin span=1h _time
| search citrtt > 150
| stats count as PbPerf by s _time
| search PbPerf >= 2
| timechart dc(s) as s span=1h
| where _time < now()
| eval time = strftime(_time, "%H:%M")
| stats sum(s) as nbs by time
| rename time as Heure
index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h
| fields citnet s
| bin span=1h _time
| search citnet > 80
| stats count as PbPerf by s _time
| search PbPerf >= 2
| timechart dc(s) as s span=1h
| where _time < now()
| eval time = strftime(_time, "%H:%M")
| stats sum(s) as nbs by time
| rename time as Heure
could you help please?
index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h
| fields citrtt citnet s
| bin span=1h _time
| stats count(eval(citrtt > 150)) as citrrt_count count(eval(citnet > 80)) as citnet_count by s _time
| stats count(eval(citrtt_count > 2)) as citrtt_s_count count(eval(citnet_count > 2)) as citnet_s_count by _time
| where _time < now()
| eval time = strftime(_time, "%H:%M")
| stats sum(citrtt_s_count) as nbs_citrtt sum(citnet_s_count) as nbs_citnet by time
| rename time as Heure
Hi @jip31
please use this
index=toto sourcetype IN ("cit","ezoptima:cit") type=* earliest=@d+7h latest=@d+19h
| fields citrtt citnet s
| bin span=1h _time
| search citrtt > 150 AND citnet > 80
| stats count as PbPerf by s _time
| search PbPerf >= 2
| timechart dc(s) as s span=1h
| where _time < now()
| eval time = strftime(_time, "%H:%M")
| stats sum(s) as nbs by time
| rename time as Heure
hi
pearhaps I am not enough clear but I need to have 2 sum results for citrtt > 150 AND citnet > 80
for example : time, citrtt, citnet
index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h
| fields citrtt citnet s
| bin span=1h _time
| stats count(eval(citrtt > 150)) as citrrt_count count(eval(citnet > 80)) as citnet_count by s _time
ther eis an issue with the field nbs_citrtt which is never calculated even if I change the threshold
There was a typo in the solution (corrected in later solutions)
| stats count(eval(citrtt > 150)) as citrtt_count count(eval(citnet > 80)) as citnet_count by s _time
OK but I need to timechart the "s" events for citrtt and citnet after the stats command like in my example, so it's not enough
This requirement is not enough to determine the solution - for example, do you want to count unique s where citrtt > 2 AND citnet > 2 or count unique s where citrtt > 2 OR citnet > 2?
I want to count unique s where citrtt > 2 OR citnet > 2
but like I said I need to timechart the s events for the citrtt and citnet so I dont know how is it possible
That is still not clear enough - do you want a single count per hour of unique s where either count is greater than 2 or do you want two counts per hour of unique s where the corresponding count is greater than 2?
two counts per hour of unique s where the corresponding count is greater than 2
index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h
| fields citrtt citnet s
| bin span=1h _time
| stats count(eval(citrtt > 150)) as citrrt_count count(eval(citnet > 80)) as citnet_count by s _time
| stats count(eval(citrtt_count > 2)) as citrtt_s_count count(eval(citnet_count > 2)) as citnet_s_count by _time
| where _time < now()
| eval time = strftime(_time, "%H:%M")
| stats sum(citrtt_s_count) as nbs_citrtt sum(citnet_s_count) as nbs_citnet by time
| rename time as Heure
now it works ;-), thanks
Please be more specific about what you are trying to do with the merged search as this will help determine the solution.
I need to display the number of citrtt and the number of citnet for each bin span _time
time, citrtt, citnet
example : 7h, 25, 8
8h, 43, 7
etc....