As @somesoni2 said, you can't actually compare across panels in a dashboard. But you could create a third panel, with this search
index=xyz host=abc (condition1) OR (condition2)
| eval commonTime = coalesce(rtime,stime)
| stats values(def) as DEF values(ghi) AS GHI by commonTime
| where isnotull(DEF) AND isnotnull(GHI)
Note that the above search requires an exact match of the time fields. Often, times may vary by as much as a few seconds and still be considered a match. If this is true in your case, you might want to use the the bin
command to "round" the time. To "round" to the second, insert the following as the third command in the sequence:
| bin span=1s commonTime
As @somesoni2 said, you can't actually compare across panels in a dashboard. But you could create a third panel, with this search
index=xyz host=abc (condition1) OR (condition2)
| eval commonTime = coalesce(rtime,stime)
| stats values(def) as DEF values(ghi) AS GHI by commonTime
| where isnotull(DEF) AND isnotnull(GHI)
Note that the above search requires an exact match of the time fields. Often, times may vary by as much as a few seconds and still be considered a match. If this is true in your case, you might want to use the the bin
command to "round" the time. To "round" to the second, insert the following as the third command in the sequence:
| bin span=1s commonTime
Thanks a lot lguinn, it is very helpful!
How about using search for both the panels to populate 3rd panel? As far as I know, for simple xml, results for one panel can't be accessed in other panel. Could you post your current query ?
Thanks for your reply:
First Panel Query : index=xyz host=abc condition1 | table rtime,def
Second Panel Query : index=xyz host=abc condition2 | table stime,ghi
I need to comparre rtime and stime from two panels and project common values in third panel.