With specific query, I can get below value for one field: {     "key1": {         "field1": x     },     "key2": {         "field2": xx     },     "key3": {         "field3": xxx     } }   Every time, the string of key1,2,3 are different, and the string of field1,2,3 are also different, even the number of key is different for each query, it may eixst key4, key5...   Now I want to get below table, could someone help on this? Thanks. Name A Name B key1 field1 key2 field2 key3 field3 ... ... ... View more

index=A | stats count as count1 index=A | dedup field1 field2 | stats count as count2 This 2 searched have same index A, then I want to calculate (count1-count2). Anyone can help on this? Thanks in advance! ... View more

First search: index=A source="FunctionHandler@*" "ul-ctx-caller-span-id"=null With this search, I can get several row data with different methods in the field ul-log-data.method, so the table will be: ul-ctx-head-span-id | ul-log-data.method ------------A-----------|---------------1------------- ------------B-----------|---------------2------------- ------------C-----------|---------------3------------- ------------D-----------|---------------2------------- Second search: index=A source="FunctionHandler@*" "ul-ctx-caller-span-id"!=null ul-ctx-head-span-id=1-5D0A0438-736C50A33B81102B75CBA44D With the field "ul-ctx-head-span-id", second search will return 2 row data with different ul-log-data.function, ul-span-duration, so the table will be: ul-ctx-head-span-id | ul-log-data.function|ul-span-duration ------------A-----------|---------------get------------- |--------xx----------- ------------A-----------|---------------post--------------|--------xx--------- Please note: the second search depends on the field "ul-ctx-head-span-id" in the result of first search. Finally, I want get a table like below: ul-ctx-head-span-id | ul-log-data.method | ul-log-data.function|ul-span-duration ------------A-----------|---------------1-------------|-----------get------------ |--------xx----------- ------------A-----------|---------------1-------------|-----------post---------- |--------xx---------- ------------B-----------|---------------2-------------|-----------get------------ |--------xx----------- ------------B-----------|---------------2-------------|-----------post---------- |--------xx---------- ------------C-----------|---------------3-------------|-----------get------------ |--------xx----------- ------------C-----------|---------------3-------------|-----------post---------- |--------xx---------- ------------D-----------|---------------2-------------|-----------get------------ |--------xx----------- ------------D-----------|---------------2-------------|-----------post---------- |--------xx---------- It means if I get 4 row data in first search, then after join, I need show 8 row data Forgive my poor English, can someone help on this? Thanks in advance ... View more

My index is as below: index | stats count by c4rupgrd-sourceVersion c4rupgrd-targetVersion I want the percentage is calculated by count in pie chart. ... View more