Multi Index combination

[jerinvarghese]

Hi All,

Need to combine 2 index together and also need the values to be added/summed together.

Code 1 : 

index=nw_syslog message_type="BGP-5-ADJCHANGE"
| stats count by nodelabel, message_type
| table nodelabel, message_type, count

Table 1 : 

nodelabel	message_type	count
AOKBF	BGP PEER LOST	2
CMPRS	BGP PEER LOST	2

Code 2: 

index=opennms 
| stats count by nodelabel, message_type
| table nodelabel, message_type, count

Table 2: 

nodelabel	message_type	count
AOKBF	BGP PEER LOST	3
CMPRS	BGP PEER LOST	3

I used append and also  join type=outer nodelabel  but the value is not added.

Expected  Table Final : 

nodelabel	message_type	count
AOKBF	BGP PEER LOST	5
CMPRS	BGP PEER LOST	5

[jerinvarghese]

Hi @gcusello ,

Got another solution 

index=nw_syslog message_type="BGP-5-ADJCHANGE"
| table nodelabel, message_type, count

| append [ search index=opennms 
| table nodelabel, message_type, count ]

| stats count by nodelabel, message_type, count

this provided me the desired value. thanks so much for your suggestion too. that to helped me in the result.

[gcusello]

Hi @jerinvarghese,

your solution is like mine, but beware if the second search could have more than 50,000 results, because there's this limit in subsearches.

then beware to use the same field name for count.

Ciao.

Giuseppe

[gcusello]

Hi @jerinvarghese,

if you have the same field names in both indexes is easier you can think:

(index=nw_syslog message_type="BGP-5-ADJCHANGE") OR (index=opennms)
| stats count BY nodelabel message_type
| table nodelabel, message_type, count

if instead you have different field names, you have to rename them to have the same field names.

In this way, you haven't the limit of 50,000 results in subsearches that you'd have using join or append.

Ciao.

Giuseppe