I have these two simple searches and I would like to combine them on one graph to display both "passed" and "failed" data. What is the most efficient way to do that? I would like to take this as an example for my future use.
index=all-mac host=eng* "unkown MAC" OR "No MAC " OR "mismatch MAC" | timechart count as Failed span=1d
and
index=al-mac host=eng* "match for MAC" | timechart count as Passed span=1d
Something like this should do..
index=all-mac host=eng* | eval STATUS= if(searchmatch("unkown MAC"), "Failed", (if(searchmatch("No MAC"),"Failed", if(searchmatch("No MAC"), "Failed", if(searchmatch("match for MAC"), "Passed","OTHER"))))) | timechart span=1d count by STATUS
If you want to compare times, week over week for example, in your timeline there is a great app that helps with that, timewrap.
Something like this should do..
index=all-mac host=eng* | eval STATUS= if(searchmatch("unkown MAC"), "Failed", (if(searchmatch("No MAC"),"Failed", if(searchmatch("No MAC"), "Failed", if(searchmatch("match for MAC"), "Passed","OTHER"))))) | timechart span=1d count by STATUS
thanks much, work as expected.
thanks much for your response! do you mind if you can tell me how "Passed" evaluate? the search key for passed is "match for MAC" so i am curious about that.
Give this one a try which will not yield the "OTHERs"
index=all-mac host=eng* "unkown MAC" OR "No MAC " OR "mismatch MAC" OR "match for MAC" | eval STATUS= if(searchmatch("match for MAC"), "Passed", "Failed") | timechart span=1d count by STATUS
Basically, base search itself filters unwanted events and this makes the STATUS calculation also simple.
I've edited my answer to consider "match for MAC" explicitly for "Passed"
thanks, it's working perfectly. something try to remove is "OTHER" is that must be there to work. i am only need Failed and Passed on my graph.
like @somesoni2 suggested, you can prefilter the data within your base search by adding
"unkown MAC" OR "No MAC " OR "mismatch MAC" OR "match for MAC"or you can also do
STATUS!="OTHER" just before your timechart