I have events with a type and an id. The id field can be null or a number where that number may repeat, e.g. type,id 1,NULL 1,NULL 1,NULL 3,1234 3.1234 1,2222 1.2222 1.2222 5,555 5,555 5,555 7,999 7,999 8,NULL I want to get a pie chart, which means I need a single column of results and I want to display 4 values type <= 3 (= class 0) type >3 (= class 1) | eval class=case(type <=3, 0, type > 3, 1) | stats count(eval(id=="NULL")) as Singles dc(id) as Multis by class | eval Class0Singles=case(class=0,Singles), Class1Singles=case(class=1,Singles), Class0Multis=case(class=0,Multis), Class1Multis=case(class=1,Multis) | fields - class Singles Multis | eval id = 1 | untable id Metric Value | fields - id The above gives me a table like this Class0Multis 2 (rows 4-8) Class0Singles 3 (first 3 rows) Class1Multis 2 (rows 9-13) Class1Singles 1 (row 14) which gets me the pie chart, but it seems rather cumbersome. I could do two counts without doing the "by class" to get the singles (id="NULL"), but the problem seems to be that it's not possible to dc(id) with a 'where class=1'. this is to produce a pie chart Is there a way to make this simpler? ... View more

I have data like: id,type,id2 1,a,100 2,a,100 3,c, 4,a,101 5,a,101 6,b,102 7,b,102 8,b,102 9,b,103 10,b,103 11,b,103 12,d,104 13,d,104 14,d,104 15,d,104 16,e, 17,c,105 18,c,105 What I am trying to do is to get the output: a=2 b=2 c=2 d=1 e=1 So, this is essentially a count of the number of 'type' where id2 are the same. In the above data, Count of (a=2) is id 1 and 2 are type 'a' and have id2=100 id 4 and 5 are type 'a' and have id2=101 Count of (b=2) is id 6,7 and 8 are type 'b' and have id2=102 id 9,10 and 11 are type 'b' and have id2=103 Count of (c=2) is id 3 is type 'c' and has no id2 id 17 and 18 are type 'c' and have id2=105 Count of (d=1) is id 12,13,14 and 15 are type 'd' and have id2=104 Count of (e=1) is id 16 is type 'e' and has no id2 and a final total of 8, which is 2+2+2+1+1 I can't figure out the search required. Note that all types may or may not have id2 and the duplication of id2 can be up to 20 instances of the same id2. ... View more

I have two types of log entry with a common field. I am using join to get the index=web_load sourcetype=instrument i_tx=func1 i_status=0 | join i_bid [ search index=web_load sourcetype=instrument i_tx=func2 ] ... The join is fine, but I am not sure what happens to fields that are in both rows with func1 and func2. I have a field i_elapsed which is the elapsed time for the function, but I am interested in min/avg/max stats about the i_elapsed field from the rows relating to func2. I can see a difference in my results if I reverse func1 and func2 round in the search, but am not sure what the rule is about common fields in the join. ... View more

I have an index with two 'transaction types'. Create and Offer. For each create, I get an ID and I want to find out all created Ids that do not get an offer. I am making multiple 'Offer' requests, so there can be more than one Offer row for each i_bid. I can do it with set diff using | set diff [ search index=web_load sourcetype=instrument i_tx=Create | stats count by i_bid | table i_bid ] [ search index=web_load sourcetype=instrument i_tx=Offer i_status=0 | stats count by i_bid | table i_bid ] | table i_bid and I get a table with the created ids from search (Create) that do not have an offer in search 2. However, I'd like to get this using stats if possible for efficiency as there will be hundreds of thousands of Create operations and set subsearches are limited to the default 10,000. I can create tables of i_bid and i_tx using index=web_load sourcetype=instrument i_status=0 i_tx=Create OR i_tx=Offer | stats count by i_tx, i_bid so, feel it ought to be possible to remove common i_bid ... View more

I've read through a number of answers, but none quite gives what I want. I have daily tests that run and my dashboard has a time picker, which is used to limit a number of cascading populating searches. These populating searches allow the user to choose a particular test date/series/name/run within the time picker range. However, I then want the time range of the earliest and latest events found in the events that match the test to be used for all subsequent inline searches in the dashboard. Problem I have at the moment is that if I do month-to-date then pick yesterday's test, the timecharts will use an automatic span for the results, so I only get a single chart point for the entire test and cannot use a fine grained span due to the range in effect. I think I need to create some kind of search that will then set tokens for the earliest/latest which can then be used in the search, but just can't work out how. ... View more

I have a log that records a transaction name, channel, and timing information, and need to calculate the maximum rate/minute for each transaction. Something along the lines of index=web_load sourcetype=instrument | eval Transaction=i_tx.":".i_chn | bucket _time span=1m | top 1 _time showperc=false by Transaction but I also want to show the corresponding min, average, max, perc95 elapsed time for that associated minute from the i_elapsed field, something like I can get from index=web_load sourcetype=instrument | eval Transaction=i_tx.":".i_chn | stats count as Count, min(i_elapsed) as Min, avg(i_elapsed) as Avg, max(i_elapsed) as Max, perc95(i_elapsed) as 95th by Transaction How can I get the min/max/avg/perc95 numbers into the table or the rate into the stats table? ... View more