I have 2 searches which from the log I calculate a difference of a number at the current time and the beginning of the day. I'd like to take the difference calculated across 2 of the hosts and add them together which would provide a total across 2 hosts.
This is what I'm using to calculate across 1 host:
index="ActiveMQ" sourcetype=jmx mbean_property_destinationName="my.queue.name" | regex host="host_7" | stats earliest(DequeueCount) AS pEarliest7 latest(DequeueCount) AS pCurrent7 by mbean_property_destinationName | eval MsgsToday7=pCurrent7-pEarliest7
2nd host would be identical except a different host name.
index="ActiveMQ" sourcetype=jmx mbean_property_destinationName="my.queue.name" | regex host="host_8" | stats earliest(DequeueCount) AS pEarliest8 latest(DequeueCount) AS pCurren8t by mbean_property_destinationName | eval MsgsToday8=pCurrent8-pEarliest8
I need the outcome to be MsgsToday7+MsgsToday8=TotalMessagesToday
... View more