I have a "cost" for two different indexes that I want to calculate in one and the same SPL. As the "price" is different depending on index, I can't just use a "by" clause in my count/sum as I don't know how to apply the separate costs in that way.
Let's say...
idxCheap costs $10 per event.
idxExpensive costs $20 per event.
I've written this SPL that works, although the "cost" data ends up in a unique column for each index. The count is still in the same column.
index=idxCheap OR index=idxExpensive
| stats count by index
| eval idxCheapCost = case(index="idxCheap", count*10)
| eval idxExpensiveCost = case(index="idxExpensive", count*20)
The results looks like this:
count idxCheapCost idxExpensiveCost index
44892 | 448920 | idxCheap | |
155 | 3100 | idxExpensive |
Any pointers on how to most efficiently and dynamically achieve this?
You're close. Combine the case functions to produce a single expense field.
index=idxCheap OR index=idxExpensive
| stats count by index
| eval idxCost = case(index="idxCheap", count*10, index="idxExpensive", count*20)
You're close. Combine the case functions to produce a single expense field.
index=idxCheap OR index=idxExpensive
| stats count by index
| eval idxCost = case(index="idxCheap", count*10, index="idxExpensive", count*20)
Haha why did I even split it up on two rows?!
Thanks!