The below returns the correct results, but I only get the RequestOne, RequestTwo, and meetscriteria fields when field1= test:
sourcetype=application_log field1= test | stats count(eval(match(_raw, "Request 1"))) AS "RequestOne", count(eval(match(_raw, "Request 2"))) AS "RequestTwo" | eval meetscriteria = if(('Request1' >= 100 AND 'Request2' > 0), "OK", "No")
I have many fields for field1 though and want to capture the counts and "meetscriteria" information for each value of field1. How can I capture this information?
I have also saved these using eventtypes and tags, but you can't group on these? Do I need to use a lookup table or a join?
I resolved it by adding a "by field1" in the second pipe and removing the field1 criteria from the initial search:
sourcetype=application_log | stats count(eval(match(_raw, "Request 1"))) AS "RequestOne", count(eval(match(_raw, "Request 2"))) AS "RequestTwo" by field1| eval meetscriteria = if(('Request1' >= 100 AND 'Request2' > 0), "OK", "No")
I had originally created eventtypes for both "Request 1" and "Request 2", but this seemed limited such that I couldn't run eval against eventtypes or do groupings.
I resolved it by adding a "by field1" in the second pipe and removing the field1 criteria from the initial search:
sourcetype=application_log | stats count(eval(match(_raw, "Request 1"))) AS "RequestOne", count(eval(match(_raw, "Request 2"))) AS "RequestTwo" by field1| eval meetscriteria = if(('Request1' >= 100 AND 'Request2' > 0), "OK", "No")
I had originally created eventtypes for both "Request 1" and "Request 2", but this seemed limited such that I couldn't run eval against eventtypes or do groupings.
Change field1=test
to field1=*
or remove the field1=
criteria altogether.