Search, use the same results for two different sub searches, then merge the results and chart them

[rpecka]

I would like to narrow down my results and rename a few fields using an initial search, let's call these results A.

Then I want to take A and search on `event_type=event1` and massage the results to get B

Then take A and search on `event_type=event2` and massage the results to get C

Then I want to combine the results B and C and use chart to dedup and display the combined result.

With my current query, the column for stage1 in my table is all null, but if I do the search with the contents of the append at the root and remove the second search, I get populated results

My current query is the following:

index=... ... | rename some_field as taskID

| append [search "event.event_type"=event1 | eval stageDuration='event.payload.total_duration'-'event.payload.provisioning_duration' | eval stageID="stage1"]

| search "event.event_type"=event2 | rename event.payload.total_duration as stageDuration event.payload.stageID as stageID

| chart sum(stageDuration) over taskID  by stageID | table taskID, stage1, * | where isnull(stage4) | fillnull value=0

[ITWhisperer · Accepted solution]

Depending on how complex your massaging is, you might want to consider combining the search and then use conditional evaluations

index-... (event.eventtype="event1" OR event.eventtype="event2")

| eval stageId=if('event.event_type'="event1","stage1","stage2")

[rpecka]

You're right. What I’m trying to do is not as complicated as I thought it was. I only need to duplicate the case statement once to get what I need. Thank you!

[PickleRick]

You're appending results with event.event_type=event1 only to filter them out in the next step by searching fpr event.eve t_type=event2.