I have a query that has multiple states represented in each log event how do i get stats based on the state values my logs look like this
event 1 : x=true, y=true, z=false
event 2 : x=false, y=false, z=true
event 3: x=true, y= false, z=true
i want track all the scenarios where the values are true for these stages(x, y, z) like.
base_search AND (x=true or y=true or z=true) | stats count by x, y, z
state | count |
x | 2 |
y | 1 |
z | 2 |
Is this possible to chart or do i have to log each state individually ?
Here's an example - the first part sets up your dataset, then shows how to use stats.
| makeresults
| eval _raw="x,y,z
true,true,false
false,false,true
true,false,true"
| multikv forceheader=1
| table x y z
| stats sum(eval(if(x="true",1,0))) as x sum(eval(if(y="true",1,0))) as y sum(eval(if(z="true",1,0))) as z
| transpose 0 column_name="state"
| rename "row 1" as count
Hope this helps
Each log statement contains only one reference to x,y,z. In your example i see you have loaded all the various states into one string. This will be represented as three messages in my case.
_raw;"setup x=true, y=false, z=false"
_raw: "setup x=true, y=true, z=false"
so when i search for setup i can get all these logs but not sure how to table these values.
The example shows 3 events, this is the part that sets up exactly the data you posted in your original post
| makeresults
| eval _raw="x,y,z
true,true,false
false,false,true
true,false,true"
| multikv forceheader=1
| table x y z
and if you run this on its own, you get 3 events, as you posted.
So, the part you need is the stats part