Given the following query, how can I append the second query so that the results show up as two rows so I can graph the results (in a pie chart).
// This query appends a new search as an additional col but what I really want i a new row.
source=*/blah/the.log "labelData= " | stats count as NOMATCHES
| appendcols [search source=*/blah/the.log labelData!="" | stats count as MATCHES ]
try the append
instead of appendcols
single query is exactly what I was looking for...I just what i was looking for...the labelData= was messing my query up as I couldn't query it by null or by labelData="". This worked awesome! Thanks!
but you could also do all in a single search with an eval
or a case
and define your own field.
example
source=*/blah/the.log "labelData= " OR labelData!=""
| eval label=if(isnull(labelData),"nomatch","match")
| stats count by label
just use "append" instead of "appendcols"