Hi, I'm trying to populate a dashboard using a base search and then pulling multiple stats from those results.
base search:
index=production sourcetype="audit" environ::LV
inline search:
| appendpipe
[ stats count AS Total by _time]
| appendpipe
[ search ("Error:" OR auditType="error")
| stats count AS error by _time]
| appendpipe
[ where auditMicroSeconds>3
| stats count AS Over BY _time]
| appendpipe
[ search ("data retrieval" AND "failed")
| stats count AS failed BY _time]
| timechart span=30s count(Total) AS Total count(error) AS Error count(Over) AS Over
But it just doesn't work. Hope this makes sense.
TIA
Steve
Solving my own question 🙂
Base search is now:
index=production sourcetype="audit" environ::LV | table *
and panel searches are:
| search (field=value OR field=value OR field=value) field=value
| appendpipe
[stats count AS total by _time]
| appendpipe
[search auditType="error"
| stats count AS error by _time]
| appendpipe
[where auditMicroSeconds>3
| stats count AS over BY _time]
| appendpipe
[search ("data retrieval" AND "failed")
| stats count AS failed BY _time]
| timechart span=30s count(error) AS Error count(over) AS Over3s count(failed) AS Failed count(total) AS Total
Data is now being presented as expected 🙂
Solving my own question 🙂
Base search is now:
index=production sourcetype="audit" environ::LV | table *
and panel searches are:
| search (field=value OR field=value OR field=value) field=value
| appendpipe
[stats count AS total by _time]
| appendpipe
[search auditType="error"
| stats count AS error by _time]
| appendpipe
[where auditMicroSeconds>3
| stats count AS over BY _time]
| appendpipe
[search ("data retrieval" AND "failed")
| stats count AS failed BY _time]
| timechart span=30s count(error) AS Error count(over) AS Over3s count(failed) AS Failed count(total) AS Total
Data is now being presented as expected 🙂
Would something like this get you what you want?
index=production sourcetype="audit" environ::LV
| eval error=if(searchmatch ("Error:" OR auditType="error"),1,null())
| eval Over=if(auditMicroSeconds>3,1,null())
| eval failed=if(searchmatch ("data retrieval" AND "failed"),1,null())
| timechart span=30s count AS Total count(error) AS Error count(Over) AS Over
Hey, Thanks for the suggestion 🙂 Unfortunately it doesn't work 😞 I had to remove the OR X and AND X from the searchmatch and then it just returned the same results as the original. Appreciated though.