help on an issue with OR condition

[jip31]

hello

when i execute the search below I have no results
index="tutu" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space" OR index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB
| eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval Value = round(Value, 1). " %"
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " GB"
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host

But no matter index I delete I have results
example :

    index="tutu" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space" 
    | eval time = strftime(_time, "%m/%d/%Y %H:%M") 
    | eval Value = round(Value, 1). " %" 
    | eval TotalSpace = TotalSpaceKB/1024 
    | eval TotalSpace = round(TotalSpace/1024,1). " GB" 
    | stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host

 index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB
    | eval time = strftime(_time, "%m/%d/%Y %H:%M") 
    | eval Value = round(Value, 1). " %" 
    | eval TotalSpace = TotalSpaceKB/1024 
    | eval TotalSpace = round(TotalSpace/1024,1). " GB" 
    | stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host

what is the issue please??

[DavidHourani · Accepted solution]

Hi @jip31,

Please use the following syntax for the first part of your query and make sure you have results :

(index="tutu" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space" ) OR (index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB)

Once this is working add the rest :

...   | eval time = strftime(_time, "%m/%d/%Y %H:%M") 
     | eval Value = round(Value, 1). " %" 
     | eval TotalSpace = TotalSpaceKB/1024 
     | eval TotalSpace = round(TotalSpace/1024,1). " GB" 
     | stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host

Let me know if it helps.

Cheers,
David

[kamlesh_vaghela]

@jip31

Have you tried this?

(index="tutu" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space") OR (index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB)
| eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval Value = round(Value, 1). " %"
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " GB"
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host