combine 3 search queries in which 2 of them are the result of the last one

[robertspeckmann]

What i am trying to accomplish is the following;

I have 3 search queries. The first one displays a single value that gives me the sum of messages that a service of us recieved and accepted on the service adapter.
I also have a query that sums up the messages that got rejected on the service adapter.
My third query shows the value of the messages that have been recieved on a different service adapter.

Is it possible to create a panel in wich i can check if the first and second query combined have the same value als the last query?
I tried to combine the queries with a append of multisearch but i cannot seem to get the result I want.

first query:
index=foo sourcetype="foo:bw" barAdapter Operation=foo | stats distinct_count(ConversationID) as Total1

second query:
index=foo sourcetype="foo:bw" "barAdapter" Operation=foo FromParty=xxx | stats count as Total2

third query:
index=foo sourcetype="foo:bw" "Publishing to endpoint Queue" Operation=foo | stats count as Total3

Thank you in advance for any help.

[dineshraj9 · Accepted solution]

You can calculate multiple statistics together in a single search and combine the results in one search this way -

index=foo sourcetype="foo:bw" Operation=foo "barAdapter" | stats distinct_count(ConversationID) as Total1,count(eval(FromParty=xxx)) as Total2 | appendcols [ search index=foo sourcetype="foo:bw" Operation=foo "Publishing to endpoint Queue"  | stats count as Total3 ]

[robertspeckmann]

Great i have solved it by your explanation dineshraj9! thank you

[robertspeckmann]

This way, it won't work since the output of Total2 is different from the first query. I just scrambled some of the data in the queries since i cannot share the real names and input.

With the query above i get a total at Total1 en Total 3 but zero results on Total2

[dineshraj9]

If your base search for Total1 and Total2 is same index=foo sourcetype="foo:bw" Operation=foo "barAdapter", then you can calculate Total1 and Total2 in the same query.

For Total2 you just need to ensure that the field FromParty is created and it has the value for which you want to calculate the count.

Alternative way would be to combine 3 searches -

index=foo sourcetype="foo:bw" barAdapter Operation=foo | stats distinct_count(ConversationID) as Total1 | appendcols [ search index=foo sourcetype="foo:bw" "barAdapter" Operation=foo FromParty=xxx | stats count as Total2 ]  | appendcols [ search index=foo sourcetype="foo:bw" "Publishing to endpoint Queue" Operation=foo | stats count as Total3 ]