i have two searches:
earliest=-10m index=perfmon server=web1 sourcetype="Perfmon:CPUTime" | stats avg(Value) as CPUUtilisation | sort -CPUUtilisation | stats first(CPUUtilisation)
and
earliest=-10m index=perfmon server=web2 sourcetype="Perfmon:CPUTime" | stats avg(Value) as CPUUtilisation | sort -CPUUtilisation | stats first(CPUUtilisation)
I got the Search 1 result as 25.5 and Search 2 result as 30.5
1. How do i compare these two values like "search2-search1=5" or "search2+search1=56"?
2. can i store search1, search2 values in some variable like $result1 ,$result2
This will do it:
earliest=-10m index=perfmon sourcetype="Perfmon:CPUTime" |stats avg(Value) as CPUUtilisation| sort -CPUUtilisation|stats first(CPUUtilisation) BY server | transpose | search column ="count" | eval sum = $row 1$ + $row 2$ | eval diff = $row 1$ - $row 2$
This will do it:
earliest=-10m index=perfmon sourcetype="Perfmon:CPUTime" |stats avg(Value) as CPUUtilisation| sort -CPUUtilisation|stats first(CPUUtilisation) BY server | transpose | search column ="count" | eval sum = $row 1$ + $row 2$ | eval diff = $row 1$ - $row 2$
got the idea. Thanks 🙂