timechart per minute by multiple fields

[sahil237888]

Hi,

I have two fields with different values and I want count on both basis. These are events and hosts occured in log files.

Example -

I have fields like host and event.
Host values are like A , B, C,D.
Events are like reboot , running, shutdown.

And the results should show like -

_time A:reboot A:shutdown B:reboot C:running
00:01 1 2 1 4
00:02 2 4 3 1
00:03 0 1 4 5
00:04 1 2 0 1

[to4kawa]

sample:

| makeresults 
| eval host="a;b", events="reboot;running;shutdown" 
| makemv delim=";" host 
| makemv delim=";" events 
| stats values(_time) as _time by host events
| stats sum(eval(events="reboot")) as reboot sum(eval(events="running")) as running sum(eval(events="shutdown")) as shutdown by _time host
| xyseries _time host reboot running shutdown sep="_"
| foreach *_* [ rename <<FIELD>> as <<MATCHSEG2>>_<<MATCHSEG1>>]

recommend:

your_search
| bin _time span=1min
| stats count(eval(events="reboot")) as reboot count(eval(events="running")) as running count(eval(events="shutdown")) as shutdown by _time host
| xyseries _time host reboot running shutdown sep="_"
| foreach *_* [ rename <<FIELD>> as <<MATCHSEG2>>:<<MATCHSEG1>>]

Hi, @sahil237888
@MuS 's way is simple and good.
However, there is a problem.
If there is no status in the search period, the status will not be displayed.
If you need to output 0 as a result of three statuses, use my query.

[MuS]

Hi sahil237888,

you need to create a new field that represent host and the events and use this in the timechart command, take a look at this run everywhere SPL:

| makeresults 
| eval host="a;b", events="reboot;running;shutdown" 
| makemv delim=";" host 
| makemv delim=";" events 
| mvexpand host 
| mvexpand events 
| eval joiner=host .":". events 
| timechart span=1min count by joiner

Hope this helps ...

cheers, MuS