About Dzmitry

Dzmitry · ‎01-05-2023

Hi Giuseppe thank you for help! May I ask one more question? This part of the query usually returns 6 columns ( host, check_id, status, info, region, msg) index="..." exec_mode="..." then I use | stats dc(status) AS status_count Values(status) AS status BY check_id | eval status=if(status_count=1 AND status="Passed","Passed","Failed") | table check_id status the table has values after it I'd like count statuses by host_name | stats count(status) BY host_name however I get 'No results found.' What am I doing wrong? Thank you

Dzmitry · ‎01-04-2023

Hi guys, I have a search for the host with check_id statuses: index="..." exec_mode="..." host="..." check_id="..." | table check_id status that returns a column with 'passed'/'failed' values I'm looking for the solution to how to check the column for 'failed' statuses in it and merge all results based on such condition: if 'failed' in statuses then statuses='failed' Table check_id status check1 Passed check1 Passed check1 Failed check1 Passed Expected result: check_id status check1 failed Thank you in advance.

Dzmitry · ‎12-22-2022

Thank you and Merry Christmas😃 final version index="..." exec_mode="..." host_name="..." (status="skipped" OR status="passed" OR status="failed") | stats dc(id) AS executed BY host_name status | stats sum(executed ) AS total BY host_name

Dzmitry · ‎12-22-2022

Unfortunately, it doesn't help. I get the same result for queries with (status="skipped" OR status="passed") and (status="skipped" OR status="passed" OR status="failed"), tried all fixed time ranges.

Dzmitry · ‎12-22-2022

Hi @gcusello I use "Last 7 days" I tried "Date range" and "Date & Time range" "Advanced" and got same issue

Dzmitry · ‎12-22-2022

Hi Team, I noticed that for some hosts search returns incorrect dc count: 1) the query to dc count ids when status is failed index=".." exec_mode="..." host_name="test_host" status="failed" | stats dc(id) AS failed BY host_name | table host_name failed (returns 1) 2) the query to dc count ids when status is skipped or passed index="..." exec_mode="..." host_name="test_host" (status="skipped" OR status="passed") | stats dc(id) AS pass_skip BY host_name | table host_name pass_skip (returns 234) 3) the query to dc count every id index="..." exec_mode="..." host_name="test_host" | stats dc(id) AS executed BY host_name | table host_name executed (returns 234) but I expect that query #3 returns sum queries 1 (failed) and 2 (skipped and passed) : 1 + 234 = 235 the I try to play with statuses in the query to get the total ids dc count 4) index="..." exec_mode="..." host_name="test_host" (status="failed" OR status!="failed") | stats dc(id) AS failed BY host_name | table host_name failed ( it returns also 234) Only 10% of hosts have such odd search behavior, for another 90% total = failed + passed/skipped Thank you in advance!

Dzmitry · ‎12-15-2022

| stats count(eval(status="pass")) AS passed count(eval(status="failed" )) AS failed BY name

Dzmitry · ‎12-15-2022

Hi Giuseppe Thank you for the help May I ask one more question? In case when I have to use count command 1) search status='passed' | stats count(status) as pass by name 2) search status='failed' | stats count(status) as failed by name then I try to combine them: 3) | stats count(eval(if(status="pass", status, 0))) AS passed count(eval(if(status="failed" , status, 0))) AS failed BY name | table name passed failed Columns have same values query 3 table pass failed Tom 16 16 Jerry 18 18

Dzmitry · ‎12-14-2022

Hello I found a strange behavior of the join command. Here are two queries: 1) search status=pass | chart dc(id) as pass by name 2) search status=failed | chart dc(id) as failed by name then I try to join these queries to get one table: 3) search status=pass | chart dc(id) as pass by name | table name pass | join name [ search status=failed | chart dc(id) as failed by name | table name failed ] | table name pass failed For some reason "failed" column values by the query #2 are different to values from join in the query #3, but "pass" column valuesare the same: query 1 table query 2 table name pass name failed Tom 12 Tom 4 Jerry 13 Jerry 5 query 3 table name pass failed Tom 12 7 Jerry 13 9

Posts	9
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎12-14-2022

Online Status	Offline
Date Last Visited	‎01-05-2023 01:03 PM

How to merge results by column values?

Why does search return incorrect dc count?

How to join changes queries data output?

Re: How to merge results by column values?

How to merge results by column values?

Re: Search returns incorrect dc count

Re: Search returns incorrect dc count

Re: Search returns incorrect dc count

Why does search return incorrect dc count?

Re: How to join changes queries data output?

Re: How to join changes queries data output?

How to join changes queries data output?

Join the Conversation