Hello,
I am looking for a way to play in a single table the results of two different indexes.
The two searches are:
index="imwaccesslog" sourcetype="IMWAccessLog" URI = /nbd-rest/rest/mch/inquiry/Inquiry/recuperaProfiloUtente | stats count Max(ETsec)
AND
index="nbdrest-performance" sourcetype="PerfNBDCustomTSV" Service = DBDisposizioniServiceImpl.recuperaProfiloUtenteBOL | stats count Max(ETms)
Any help would be greatly appreciated.
Thanks in advance!
Hi carlpier,
Something like this sould work:
index="imwaccesslog" OR index=nbdrest-performance sourcetype="IMWAccessLog" OR sourcetype="PerfNBDCustomTSV" URI=/nbd-rest/rest/mch/inquiry/Inquiry/recuperaProfiloUtente OR Service=DBDisposizioniServiceImpl.recuperaProfiloUtenteBOL | stats count Max(ETms) Max(ETsec)
Hope this helps to get you started ...
cheers, MuS
thanks, I would like to separate the two counts by adding a where conditions for both searches:
eventstats perc95(ETsec) as resp_time_95_L by FIELD1 | where ETsec < resp_time_95_L | chart count avg(ETsec) stdev(ETsec) range(ETsec) min(ETsec) max(ETsec) by FIELD1| sort count | reverse
and
eventstats perc95(ETms) as resp_time_95_P by FIELD2 | where ETms < resp_time_95_P | chart count
avg(ETms) stdev(ETms) range(ETms) min(ETms) max(ETms) by FIELD2| sort count | reverse