How do I combine two searches with single where.
index =ax "Student enrolled in class by dean" | rex "classId=(?<sId>[0-9]+)" | where classId=1001| stats count as StudentsEnrolledByDean | appendcols [search index=ax "Student self-registered in class " | rex "classId: (?<classId>[0-9]+)" | where classId=1001| stats count as SelfRegisteredStudentCount] | transpose
How do I combine the search like above with a single where classId=1001
and print count of StudentsEnrolledByDean and SelfRegisteredStudentCount who are going to attend same class with classId = 1001?
These are just example log strings. I didn't want to put actual log strings. So please don't look at these log strings logically.
Try something like this
index=ax "Student enrolled " OR "student graduated " "sId: 1001" | eval EnrolledStudents=if(searchmatch("Student enrolled "),1,0) | eval GraduatedStudents=abs(1-EnrolledStudents) | table EnrolledStudents, GraduatedStudents | stats sum(*) as *
If this doesn't work, try this
index=ax "Student enrolled " OR "student graduated " | rex "sId=(?<sId>[0-9]+)" | where sId=1001 | eval EnrolledStudents=if(searchmatch("Student enrolled "),1,0) | eval GraduatedStudents=abs(1-EnrolledStudents) | table EnrolledStudents, GraduatedStudents | stats sum(*) as *
Try something like this
index=ax "Student enrolled " OR "student graduated " "sId: 1001" | eval EnrolledStudents=if(searchmatch("Student enrolled "),1,0) | eval GraduatedStudents=abs(1-EnrolledStudents) | table EnrolledStudents, GraduatedStudents | stats sum(*) as *
If this doesn't work, try this
index=ax "Student enrolled " OR "student graduated " | rex "sId=(?<sId>[0-9]+)" | where sId=1001 | eval EnrolledStudents=if(searchmatch("Student enrolled "),1,0) | eval GraduatedStudents=abs(1-EnrolledStudents) | table EnrolledStudents, GraduatedStudents | stats sum(*) as *