How to merge 2 search in one search?

[jip31]

Hello

I use 2 separate search almost identical

Now I want to merge these 2 search in one search

Here is the search

index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h 
| fields citrtt s 
| bin span=1h _time 
| search citrtt > 150 
| stats count as PbPerf by s _time 
| search PbPerf >= 2 
| timechart dc(s) as s span=1h 
| where _time < now() 
| eval time = strftime(_time, "%H:%M") 
| stats sum(s) as nbs by time 
| rename time as Heure

index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h 
| fields citnet s
| bin span=1h _time 
| search citnet > 80
| stats count as PbPerf by s _time 
| search PbPerf >= 2 
| timechart dc(s) as s span=1h 
| where _time < now() 
| eval time = strftime(_time, "%H:%M") 
| stats sum(s) as nbs by time  
| rename time as Heure

could you help please?

[SanjayReddy]

Hi @jip31 

please use this

index=toto sourcetype IN ("cit","ezoptima:cit") type=* earliest=@d+7h latest=@d+19h
| fields citrtt citnet s
| bin span=1h _time
| search citrtt > 150 AND citnet > 80
| stats count as PbPerf by s _time
| search PbPerf >= 2
| timechart dc(s) as s span=1h
| where _time < now()
| eval time = strftime(_time, "%H:%M")
| stats sum(s) as nbs by time
| rename time as Heure

[jip31]

hi

pearhaps I am not enough clear but I need to have 2 sum results for citrtt > 150 AND citnet > 80

for example :  time, citrtt, citnet

[ITWhisperer]

index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h 
| fields citrtt citnet s 
| bin span=1h _time 
| stats count(eval(citrtt > 150)) as citrrt_count count(eval(citnet > 80)) as citnet_count by s _time

[jip31]

ther eis an issue with the field nbs_citrtt which is never calculated even if I change the threshold 

[ITWhisperer]

There was a typo in the solution (corrected in later solutions)

| stats count(eval(citrtt > 150)) as citrtt_count count(eval(citnet > 80)) as citnet_count by s _time

[jip31]

OK but I need to timechart the "s" events for citrtt and citnet after the stats command like in my example, so it's not enough

[ITWhisperer]

This requirement is not enough to determine the solution - for example, do you want to count unique s where citrtt > 2 AND citnet > 2 or count unique s where citrtt > 2 OR citnet > 2?

[jip31]

I want to count unique s where citrtt > 2 OR citnet > 2

but like I said I need to timechart the s events for the citrtt and citnet so I dont know how is it possible

[ITWhisperer]

That is still not clear enough - do you want a single count per hour of unique s where either count is greater than 2 or do you want two counts per hour of unique s where the corresponding count is greater than 2?

[jip31]

two counts per hour of unique s where the corresponding count is greater than 2

[ITWhisperer · Accepted solution]

index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h 
| fields citrtt citnet s 
| bin span=1h _time 
| stats count(eval(citrtt > 150)) as citrrt_count count(eval(citnet > 80)) as citnet_count by s _time
| stats count(eval(citrtt_count > 2)) as citrtt_s_count count(eval(citnet_count > 2)) as citnet_s_count by _time
| where _time < now() 
| eval time = strftime(_time, "%H:%M") 
| stats sum(citrtt_s_count) as nbs_citrtt sum(citnet_s_count) as nbs_citnet by time 
| rename time as Heure

[jip31]

now it works ;-), thanks

[ITWhisperer]

Please be more specific about what you are trying to do with the merged search as this will help determine the solution.

[jip31]

I need to display the number of citrtt and the number of citnet for each bin span _time

time, citrtt, citnet

example : 7h,  25, 8

                     8h, 43, 7

etc....