best approach for sub search with total

[adomila]

Hi, I've the ff search

main search for getting total ...
| join type=outer _time 
[ search main search for getting total ... | WHERE duration>0.01 ]

RESULT:

_time	exceeded	total	percentage
2013-06-18 00:00:00	2	113	1.769912
2013-06-18 00:05:00	1	120	0.833333
2013-06-18 00:10:00	3	101	2.970297

The only difference between the main search w/ the sub search is the "WHERE duration>0.01"


My script is working fine. I just not sure if the is the best approach or if this could still be optimized by not using sub search.



tia (tnx in advance)

[martin_mueller]

Great. I have converted my comment to an answer so you can mark it as solved.

[adomila]

It works. Many thanks and be safe on your way home on a train.

[martin_mueller · Accepted solution]

In short, try something like this:

sourcetype... | timechart span=5m count as total count(eval(duration>0.01)) as exceeded

Can't test, on the train home...

[adomila]

Thanks Martin.

[adomila]

Allow me to provide specifics. Here is the exact script:

sourcetype=abc

| bucket _time span=5m

| stats count(ref_num) as total_trans by _time

| join type=outer _time

[ search

sourcetype=abc | WHERE duration>0.01

| bucket _time span=5m

| stats sum(ref_num) as exceeded_trans by _time

]

It is noticeable that the only difference between the main and sub search is the WHERE condition that computes the exceeded transactions. How can I achieve the same RESULT:(stated above) w/o using join or sub search?

[martin_mueller]

That depends on what you're trying to achieve.

For example, if you describe the roads you're driving on to me and ask whether they are the fastest route... I won't be able to answer that without knowing your destination.

[adomila]

Hi Martin,
I'm trying to find out if what I have done is the best approach out there; can it be done without using join and sub search? tia.

[martin_mueller]

What are you trying to achieve?