I want to determine the top n days of a time period based on a criteria and then get some statistics only on those days.
Do I use a subsearch?
I can write the searches for these two things separately but I cannot link them. Also I don't know how to pass specific days as parameters to my search.
I have something like this for determining the days:
index=potato
| bin _time span=1d
| stats sum(piece) AS sum_piece BY _time
| sort -sum_piece
| head 3
How can I pass this? Or is there a simpler solution?
Thanks
Hi gibir,
let me know:
do you want to find the top three days and then use these dates in another search?
if this is your need you could try someting like this
index=my index
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search
index=potato
| bin _time span=1d
| stats sum(piece) AS sum_piece BY _time
| sort -sum_piece
| head 3
| eval day=strftime(_time,"%Y-%m-%d")
| fields day
]
| ...
If you want to use the same time boundaries of the subsearhc in the main search you could use:
index=my index [ search
index=potato
| bin _time span=1d
| stats sum(piece) AS sum_piece BY _time
| sort -sum_piece
| head 3
| eval day=strftime(_time,"%Y-%m-%d")
| stats earliest(day) AS earliest latest(day) AS latest values(day) AS day
| fields earliest latest
]
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search
index=potato
| bin _time span=1d
| stats sum(piece) AS sum_piece BY _time
| sort -sum_piece
| head 3
| eval day=strftime(_time,"%Y-%m-%d")
| fields day
]
| ...
Bye.
Giuseppe
Hi gibir,
let me know:
do you want to find the top three days and then use these dates in another search?
if this is your need you could try someting like this
index=my index
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search
index=potato
| bin _time span=1d
| stats sum(piece) AS sum_piece BY _time
| sort -sum_piece
| head 3
| eval day=strftime(_time,"%Y-%m-%d")
| fields day
]
| ...
If you want to use the same time boundaries of the subsearhc in the main search you could use:
index=my index [ search
index=potato
| bin _time span=1d
| stats sum(piece) AS sum_piece BY _time
| sort -sum_piece
| head 3
| eval day=strftime(_time,"%Y-%m-%d")
| stats earliest(day) AS earliest latest(day) AS latest values(day) AS day
| fields earliest latest
]
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search
index=potato
| bin _time span=1d
| stats sum(piece) AS sum_piece BY _time
| sort -sum_piece
| head 3
| eval day=strftime(_time,"%Y-%m-%d")
| fields day
]
| ...
Bye.
Giuseppe