About lslschr

lslschr · ‎04-21-2021

just found out the answer after testing some times: Simply used | stats values(*) as * by JobID

lslschr · ‎04-21-2021

Hello Together I have a little difficulty with the merging of cells. The idea is that if the results for the value JobID in the table have the same value, the entries for Start Time and End Time should be merged. index=MYINDEX host=MYHOST sourcetype=regway:server status=COMPLETED | eval "End Time"=strftime(_time,"%c") | append [ search index=MYINDEX host=MYHOST sourcetype=MYINDEX:server "Created metadata export job with id:" | rex "id: (?<JobID>\w{1,}-\w{1,}-\w{1,}-\w{1,}-\w{1,})" | eval "Start Time"=strftime(_time,"%c")] | sort JobID | table "Start Time", "End Time" , JobID My Result looks currently like this:

lslschr · ‎04-15-2021

index=xy device_event_class_id=Bandwidth earliest=-1d@d latest=-0d@d | rex field=msg "msg=.+raffic.+'(?<pg_name>[\w\s\-]+)'.+(?<bps>\d+\.\d+\s.+)\..+" | eval ReportKey="yersterday" | timechart span=3h count by pg_name | append [search index=xy device_event_class_id=Bandwidth earliest=-2d@d latest=-1d@d | rex field=msg "msg=.+raffic.+'(?<pg_name>[\w\s\-]+)'.+(?<bps>\d+\.\d+\s.+)\..+" | eval ReportKey="beforeyesterday" | timechart span=3h count by pg_name ] | fillnull value=0 | eval mytime=strftime(_time, "%H:%M") | sort mytime I'm trying to create a chart containing two timecharts for different time frames (today/yesterday). How can I achieve it? Currently I'm getting it one after another. I'd like basically to overlay one timechart on another one.

Posts	3
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎04-15-2021

Online Status	Offline
Date Last Visited	‎01-21-2022 03:37 PM

Merge cells together when having one same Value

Overlay two time based grouped results in a Chart

Re: Merge cells together when having one same Valu...

Merge cells together when having one same Value

Overlay two time based grouped results in a Chart