multisearch in table format

[shashidharh]

Hi,

I was trying to add 2 searches

| multisearch [search host=p-css* SRCreateRequest 400 | stats count as CreateSR 
            | appendcols [search host=p-css* SRUpdateRequest 400 | stats count as UpdateSR]
            | appendcols [search host=p-css*  SREscalateRequest 400 | stats count as EscalateSR]
            | appendcols [search host=p-css*  SRCloseRequest 400 | stats count as CloseSR]
            | eval type="400"]
	  [appendcols search host=p-css* SRCreateRequest Publisher: Completed | stats count as CreateSR 
            | appendcols [search host=p-css* SRUpdateRequest Publisher: Completed | stats count as UpdateSR]
            | appendcols [search host=p-css*  SREscalateRequest Publisher: Completed | stats count as EscalateSR]
            | appendcols [search host=p-css*  SRCloseRequest Publisher: Completed | stats count as CloseSR]
 | eval type="Completed"]
| chart count(Name) over 400 by Completed

Getting error "Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)."

My expected output  will be having a table format:

giving some example here

API	400	Completed
CreateSR	30	50
UpdateSR	5	25
CloseSR	24	30

[richgalloway]

Appendcols is not a streaming command and cannot be used in multisearch.

[shashidharh]

ohk, what could be the good solution for this query to get above result ?

[ITWhisperer]

It depends what your data looks like!

Assuming you have fields API, status, publisher and completed, 

host=p-css* (SRCreateRequest OR SRUpdateRequest OR SREscalateRequest OR SRCloseRequest) (400 OR (Publisher: AND Completed))
| eval fourhundred=if(status=400, 1, 0)
| eval complete=if(publisher="Publisher:" AND completed="Completed", 1, 0)
| stats sum(fourhundred) as "400" sum(complete) as Completed by API

[shashidharh]

yes, it is not giving the output..

but modified as below .. here all APIs are not showing along with "Completed"

anything wrong ?

 

[ITWhisperer]

There doesn't appear to be anything wrong, the absence of Completed and the other APIs from the results probably means they are absent from the events in your selected time period.

[shashidharh]

hm yes, is it possible to display those columns & rows where we have "zero" values ?