how to get this two stats result in one query
(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq (this dq field is not present in ho_sum)
| stats latest(first) as first_vu
latest(last) as last_vu
latest(index) as index_1
by dev_id sourcetype
thankyou for the reply ,is there is any other way of doing it
You can try this, but I don't know if that is the solution you need:
(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| fillnull dq
| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq sourcetype
yes ,i have two different searches ,but i need to use output of one filed and to use in another
Then my solution seams to solve your problem. Have you tried to let it run like my suggestion was? Put the whole text (both blocks) into your search bar.
(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq (this dq field is not present in ho_sum)
| append [search (earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| stats latest(first) as first_vu
latest(last) as last_vu
latest(index) as index_1
by dev_id sourcetype]
Here you have one query but two searches but one result set. Using it this way isn't that nice because as mentioned you have two separate searches.