Hi,
I have this search:
index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |stats sparkline(avg(stat_val)) as "Trend" first(stat_val) as "Current Cell Connectivity %" by mso|rename mso as "MSO - Click for Expanded View"
Which produces this Statistics Table (first column intentionally omitted)
What I'd like to do is append to the table at the bottom a row that indicates Avg, mean, etc of the data. I've tired append and appendpipe but the data never seems to display. (note: I've never used append or appendpipe before so it is VERY likely it is something I'm doing wrong)
Try moving the appendpipe
to after the stats
command. Like this
index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |stats sparkline(avg(stat_val)) as "Trend" first(stat_val) as "Current Cell Connectivity %" by mso |appendpipe [stats avg(stat_val) as "Current Cell Connectivity %" | eval mso = "ALL MSO's"] |rename mso as "MSO - Click for Expanded View"
Try moving the appendpipe
to after the stats
command. Like this
index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |stats sparkline(avg(stat_val)) as "Trend" first(stat_val) as "Current Cell Connectivity %" by mso |appendpipe [stats avg(stat_val) as "Current Cell Connectivity %" | eval mso = "ALL MSO's"] |rename mso as "MSO - Click for Expanded View"
Hi Sundareshr,
I tried that one as well hoping it would do the trick but when I do the resulting table doesn't have any of the entries.
Meaning, no average and no "ALL MSO's" in the first column. I only got the ALL MSO's to show up when I put the appendpipe before the stats command
Then try this..
index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |stats sparkline(avg(stat_val)) as "Trend" first(stat_val) as "Current Cell Connectivity %" by mso |append [search index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2))
stats avg(stat_val) as "Current Cell Connectivity %" | eval mso = "ALL MSO's"] |rename mso as "MSO - Click for Expanded View"
BINGO!!!! Thank you Sundareshr!!!!
updated query, a bit closer but still not quite there
This one does get an entry into the first column (the one that was omitted) but no entry in the last column
index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |appendpipe [stats avg(stat_val) as "Current Cell Connectivity %" | eval mso = "ALL MSO's"]|stats sparkline(avg(stat_val)) as "Trend" first(stat_val) as "Current Cell Connectivity %" by mso|rename mso as "MSO - Click for Expanded View"