how to show multiple columns in table along with timestamp

[rkishoreqa]

Hi team,

I have one requirement to prepare a query to get a value from json and do chart count around it. For this I have added multiple chart count queries using appendcols, but it is very slow.  Also I need the timestamp. 

log is like as below: 

Success: 1
failed: 2
Total: 3

index=<<>> |search app="app1" |rex "Total: (?<TCount>[^\"]*)" |eval TCount=rtrim(TCount,"\\") |chart count(TCount) over TCount |appendcols [search |rex "Success: (?<S_Count>[^\"]*)"|eval S_Count=rtrim(S_Count,"\\") |chart count(S_Count) over S_Count]
|appendcols [search |rex "failed: (?<FCount>[^\"]*)"|eval F_Count=rtrim(FCount,"\\") |chart count(FCount) over FCount]

Can anyone help me on this to make it run faster. 

Thanks in Advance.

[richgalloway]

Appendcols is almost always the wrong command.  I probably should do a B-Side talk on it, but for now just forget you ever heard of appendcols.

As for what you should do, well that depends on what you want the output to be.  Please share.

[rkishoreqa]

@richgalloway  I want the output as below. 

Value   SuccessCount          value    FailedCount           value       TotalCount
  1                  1                                 2               1                             3                      1

[richgalloway]

This would be the rare case where appendcols is actually useful.

None of the alternatives I've tried work so it's a matter of making what you have work faster.  Use the usual methods for doing that: filter as much as and as soon as possible; reduce the time range as much as possible; make sure the data is well balanced among your indexers.