How to combine two fields in a subsearch and return them together

[ivykp]

Hey guys,
I have the next query:

index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
| eval x = [search index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
| rename RESULTADO_VALIDACION.PROVISION_COMISION.RESULTADO as RESULTADO, RESULTADO_VALIDACION.PROVISION_COMISION.SUMA_GW as SUMA_GW
| dedup IDENTIFICADOR_ENTIDAD sortby +_time -FECHA_SAP
| eval SUMA_DELTA_OK=if((RESULTADO=="OK"), SUMA_GW, 0)
| eval SUMA_DELTA_ERROR=if((RESULTADO!="OK"), SUMA_GW, 0)
| stats count as DELTA_PROVISION sum(SUMA_DELTA_OK) as SUMA_DELTA_OK sum(SUMA_DELTA_ERROR) as SUMA_DELTA_ERROR
| eval result = ???
| return $result]
| table x

As you can see i have this two fields SUMA_DELTA_OK and SUMA_DELTA_ERROR, i need to return both of them as result of the subsearch so i avoid to make a subsearch for OK and ERROR.

Any idea how to do this? returning a tuple, and array or something? Also how do i extract them after that.

Thanks!

[somesoni2]

In your main search, only thing you're doing is displaying result of subsearch in each row. Do you really want to do that or it's just half search you wrote to post question here? If you really want to do that, just run the subsearch as main search.

index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
 | rename RESULTADO_VALIDACION.PROVISION_COMISION.RESULTADO as RESULTADO, RESULTADO_VALIDACION.PROVISION_COMISION.SUMA_GW as SUMA_GW
 | dedup IDENTIFICADOR_ENTIDAD sortby +_time -FECHA_SAP
 | eval SUMA_DELTA_OK=if((RESULTADO=="OK"), SUMA_GW, 0)
 | eval SUMA_DELTA_ERROR=if((RESULTADO!="OK"), SUMA_GW, 0)
 | stats count as DELTA_PROVISION sum(SUMA_DELTA_OK) as SUMA_DELTA_OK sum(SUMA_DELTA_ERROR) as SUMA_DELTA_ERROR

If you really have some further calculations to be done based on two fields you want to return, you can return a concatenated field and split it later.

index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
 | eval x = [search index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
 | rename RESULTADO_VALIDACION.PROVISION_COMISION.RESULTADO as RESULTADO, RESULTADO_VALIDACION.PROVISION_COMISION.SUMA_GW as SUMA_GW
 | dedup IDENTIFICADOR_ENTIDAD sortby +_time -FECHA_SAP
 | eval SUMA_DELTA_OK=if((RESULTADO=="OK"), SUMA_GW, 0)
 | eval SUMA_DELTA_ERROR=if((RESULTADO!="OK"), SUMA_GW, 0)
 | stats count as DELTA_PROVISION sum(SUMA_DELTA_OK) as SUMA_DELTA_OK sum(SUMA_DELTA_ERROR) as SUMA_DELTA_ERROR
 | eval result = "DELTA_PROVISION=".DELTA_PROVISION." SUMA_DELTA_OK=".SUMA_DELTA_OK." SUMA_DELTA_ERROR=".SUMA_DELTA_ERROR
 | return $result] 
 | table x
 | rex field=x "DELTA_PROVISION=(?<DELTA_PROVISION>\S+) SUMA_DELTA_OK=(?<SUMA_DELTA_OK>\S+) SUMA_DELTA_ERROR=(?<SUMA_DELTA_ERROR>\S+)"