Hi Team,
Again an urgent requirement. I have got a couple csv files with source name c:\\budapest.csv
, c:\\singapore.csv
, c:\\germany.csv
etc
All I wantt is some stats sorted with country and run the same search on all other files.
Right now I have a searcj where I am appending each and every source file with the same search which is becoming bigger as I add more subsearches:
source="C:\\Budapest Router1full.csv" host="SEZ00VVM-153" sourcetype="csv" date_wday!=saturday AND date_wday!=sunday| rex field=source "(?<country>.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename |where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=IN/1048576 |bin _time span=1mon| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time |eval total=Percentile/maxin*100|timechart span=1d values(total) As Budapest(total%)|append[search source="C:\\Adelaide full.csv" date_wday!=saturday AND date_wday!=sunday| rex field=source "(?<country>.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename |where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=IN/1048576 |bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time |eval total=Percentile/maxin*100|timechart span=1d values(total) As Adelaide(total%)]
Please help
Thanks ,
Deepthi
To use same query for different sources:
source=budapest.csv OR source=singapore.csv OR source=germany.csv | *your search...*
To use same query for different sources:
source=budapest.csv OR source=singapore.csv OR source=germany.csv | *your search...*