If I understood correctly append returns the result in the same row as the previous query. Anyone knows why I get 2 separate rows in my results: 1 row with the foo number and another with the bar number? And no DiffPercent?
earliest=-5m@m latest=@m <my query> |stats sum(eval(MessageCount)) as foo | append [search earliest=-10m@m latest=-5m@m <same query> |stats sum(eval(MessageCount)) as bar] | append [eval DiffPercent = (bar - foo) / bar * 100]
Yes this is what append
does, append row of results after the existing ones.
If you want to add columns, you may want to look at appendcols
(but they may not be aligns)
or the join
function (using a common field for the join)
Or simply use the append
, adding an extra stats
or timechart
after to reformat.
earliest=-5m@m latest=@m <my query>
|stats sum(eval(MessageCount)) as foo
| eval title="5monthsago"
| append [
search earliest=-10m@m <same query>
|stats sum(eval(MessageCount)) as bar
| eval title="10monthsago"
]
| stats values(foo) AS foo values(bar) AS bar
| eval DiffPercent = (bar - foo) / bar * 100
[edit value to values]
Yes this is what append
does, append row of results after the existing ones.
If you want to add columns, you may want to look at appendcols
(but they may not be aligns)
or the join
function (using a common field for the join)
Or simply use the append
, adding an extra stats
or timechart
after to reformat.
earliest=-5m@m latest=@m <my query>
|stats sum(eval(MessageCount)) as foo
| eval title="5monthsago"
| append [
search earliest=-10m@m <same query>
|stats sum(eval(MessageCount)) as bar
| eval title="10monthsago"
]
| stats values(foo) AS foo values(bar) AS bar
| eval DiffPercent = (bar - foo) / bar * 100
[edit value to values]
Just needed to change value
to values
. And it's 5minutesago
instead of 5monthsago
. Thanks @yannK!
I get this error - Error in 'stats' command: The argument 'value(foo)' is invalid.