I have the following combinations of name and code:
Name Code
AAA M
BBB C
ZZZ K
…
…
…
[fixed combination of these, like 10 or so].
For each of these Name/Code combinations, I want to run the following search and store the output to a summary index:
index=common sourcetype=web
| eval match = if((some_name_1=AAA AND some_code_1=M ) OR (some_name_2=AAA AND some_code_2=M ), 1, 0)
| eval some_name=AAA
| eval some_code=M
| bucket _time span =1h
| stats count(eval(price=1) AND NOT(some_name_2!="AAA" AND some_flag=Y) OR …..) as totalEquals, count as total by _time, some_name, some_code
| eval pct=round((totalEquals/total)*100,2)
| stats max(pct) max(total) by _time some_name some_code
| collect index=summary_index source="SOME_STATS"
I am planning to store above Name/Code combination in KV Store and iterate through the combination and pass them to the above search. Wondering what is the best way to loop through and get the results?
... View more