Multiple Stats from Base Search

[cdstealer]

Hi,  I'm trying to populate a dashboard using a base search and then pulling multiple stats from those results.

base search: 

index=production sourcetype="audit" environ::LV

inline search: 

| appendpipe 
    [ stats count AS Total by _time] 
| appendpipe 
    [ search ("Error:" OR auditType="error") 
    | stats count AS error by _time] 
| appendpipe 
    [ where auditMicroSeconds>3 
    | stats count AS Over BY _time] 
| appendpipe 
    [ search ("data retrieval" AND "failed") 
    | stats count AS failed BY _time] 
| timechart span=30s count(Total) AS Total count(error) AS Error count(Over) AS Over

 But it just doesn't work.  Hope this makes sense.

TIA

Steve

[cdstealer · Accepted solution]

Solving my own question 🙂

Base search is now:

index=production sourcetype="audit" environ::LV | table *

and panel searches are:

| search (field=value OR field=value OR field=value) field=value 
| appendpipe 
    [stats count AS total by _time] 
| appendpipe 
    [search auditType="error" 
    | stats count AS error by _time] 
| appendpipe 
    [where auditMicroSeconds>3 
    | stats count AS over BY _time] 
| appendpipe 
    [search ("data retrieval" AND "failed") 
    | stats count AS failed BY _time] 
| timechart span=30s count(error) AS Error count(over) AS Over3s count(failed) AS Failed count(total) AS Total

 Data is now being presented as expected 🙂

[ITWhisperer]

Would something like this get you what you want?

index=production sourcetype="audit" environ::LV
| eval error=if(searchmatch ("Error:" OR auditType="error"),1,null())
| eval Over=if(auditMicroSeconds>3,1,null()) 
| eval failed=if(searchmatch ("data retrieval" AND "failed"),1,null())
| timechart span=30s count AS Total count(error) AS Error count(Over) AS Over

[cdstealer]

Hey, Thanks for the suggestion 🙂  Unfortunately it doesn't work 😞  I had to remove the OR X and AND X from the searchmatch and then it just returned the same results as the original.  Appreciated though.