Let's say you have a log that looks like....
X -- Y -- Z
=== === ===
AAA BBB 123
AAA BBB 356
YYY ZZZ 800
AAA BBB 900
YYY ZZZ 345
What query would allow me to extract the highest number Z where X and Y are equal.
So for the example above, I would expect to see results like:
AAA BBB 900
YYY ZZZ 800
Thanks.
Well, depending on the nature of X and Y, there are a couple of options, one of them being a simple string concatenation for the comparison:
... | eval Q = X." ".Y | stats max(Z) AS Z by Q | rename Q AS "X and Y"
which would give you a table like;
X and Y Z
AAA BBB 900
CCC DDD 800
Hope this helps,
Krisitan
Well, depending on the nature of X and Y, there are a couple of options, one of them being a simple string concatenation for the comparison:
... | eval Q = X." ".Y | stats max(Z) AS Z by Q | rename Q AS "X and Y"
which would give you a table like;
X and Y Z
AAA BBB 900
CCC DDD 800
Hope this helps,
Krisitan
Thanks much!!
The dot (.) is the concatenation operator; so the eval statement creates the 'AAA BBB' and 'CCC DDD' strings, which appear under the 'X and Y' heading.
Of course, this could have been illustrated better with proper log events.
The reason for doing so is that you'll need to find the highest value for the combination of A and Y.
/k
Perfect. Thanks so much!! But can you explain the "eval Q = X." ".Y" portion of that. I don't quite get that...
Explain how X and Y are equal in the lines you're expecting to see? Also, do you mean that the actual log event looks like this in a kind of tabular format?