Is there any way to have the below query without map command?

[Abilan1]

Hi ,

With the below query, am facing issue while creating dashboard, as it is having a map command.

index=Test host=XXX "ABNUM" | map search="search source=$source$ | streamstats current=f last(_raw) AS next_line | search \" took \" next_line=\"ABNUM\"" | dedup _raw next_line | rex "query took (?\d+).*((?\d+) seconds)"

is there any other way to make the same without map command.

[techusky]

I'm not sure if this is the problem you are facing, but you can use the "map" command in dashboards just fine... however, since dashboards use the $field$ syntax to represent any input values to the dashboard (and map commands use the same syntax to reference the value of a given input field), you need to add a second $ around any variables in your map command. So for instance, when you define your search inside your dashboard, it would be something like this:

index=Test host=XXX "ABNUM" | map search="search source=$$source$$ | streamstats current=f last(_raw) AS next_line
| search \" took \" next_line=\"ABNUM\"" | dedup _raw next_line | rex "query took (?\d+).*((?\d+) seconds)"

[Abilan1]

It is not working on search, not sure I didn't try for dashboard. am looking for a query which works in both dashboard as well as search.

[sideview]

Can you add a row of two to illustrate what your raw data looks like? I think that would help us answer your question better.

Also, this is a bit off the cuff, but I have a suspicion that what you need revolves around using the somewhat advanced "by" argument to streamstats.

index=Test host=XXX "ABNUM" | streamstats current=f last(_raw) AS next_line by source | .... 

[Abilan1]

Hi,

I would like to capture the seconds which is highlighted on the below logs and only for the table ABNUM (which is on next event).

Note: There are other tables like EmpID,USER,etc..will also be a part of the source file. But I need only for ABNUM table's query time. Please let me know if you need any additional information.

Log File:

Sun Mar 27 13:07:28.654666 doQueryDiagnostics: The following SQL query took 4 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds)

Sun Mar 27 13:07:28.654975 SELECT * FROM ABNUM WHERE ( RPAN8 = 68537110.000000 )

[javiergn]

You could use a subsearch. Something like:

index=foo [
    search index=Test host=XXX "ABNUM" | dedup source | table source
] 
| streamstats current=f last(_raw) AS next_line 
| search " took " next_line="ABNUM"
| dedup _raw next_line 
| rex "query took (?\d+).*((?\d+) seconds)"