Hi All,
Need to combine 2 index together and also need the values to be added/summed together.
Code 1 :
index=nw_syslog message_type="BGP-5-ADJCHANGE"
| stats count by nodelabel, message_type
| table nodelabel, message_type, count
Table 1 :
nodelabel | message_type | count |
AOKBF | BGP PEER LOST | 2 |
CMPRS | BGP PEER LOST | 2 |
Code 2:
index=opennms
| stats count by nodelabel, message_type
| table nodelabel, message_type, count
Table 2:
nodelabel | message_type | count |
AOKBF | BGP PEER LOST | 3 |
CMPRS | BGP PEER LOST | 3 |
I used append and also join type=outer nodelabel but the value is not added.
Expected Table Final :
nodelabel | message_type | count |
AOKBF | BGP PEER LOST | 5 |
CMPRS | BGP PEER LOST | 5 |
Hi @gcusello ,
Got another solution
index=nw_syslog message_type="BGP-5-ADJCHANGE"
| table nodelabel, message_type, count
| append [ search index=opennms
| table nodelabel, message_type, count ]
| stats count by nodelabel, message_type, count
this provided me the desired value. thanks so much for your suggestion too. that to helped me in the result.
Hi @jerinvarghese,
your solution is like mine, but beware if the second search could have more than 50,000 results, because there's this limit in subsearches.
then beware to use the same field name for count.
Ciao.
Giuseppe
Hi @jerinvarghese,
if you have the same field names in both indexes is easier you can think:
(index=nw_syslog message_type="BGP-5-ADJCHANGE") OR (index=opennms)
| stats count BY nodelabel message_type
| table nodelabel, message_type, count
if instead you have different field names, you have to rename them to have the same field names.
In this way, you haven't the limit of 50,000 results in subsearches that you'd have using join or append.
Ciao.
Giuseppe