How to write search query with two commands

[geetanjali]

Hello,

I have 3 guest and each guest has 10 hosts in it. i want to display data in pie chart.

my query conditions are :

Want to display sum of latest value over hosts by guest.
First i need to find out latest values of host and then sum up that values guest.

My current query is:-

index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | chart first(Power_consumption) as a over host by guest

This query is giving latest values of hosts by guest. Next i need to sum up latest values. What would be the approach to do this.

Please help, if anybody knows the solution.

Thanks in advance.

Geetanjali

[woodcock]

Keep your original search for the first need and use this one for the other need:

index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | stats first(Power_consumption) as a BY host,guest | stats sum(a) BY host

[Ant1D]

Sounds like you could use the addtotals search command so try the following search query: your_search | addtotals