I have a search like this
sourcetype="syslog" | ... | stats c(eval(range="alpha")) AS ALPHA_COUNT c(eval(range="beta")) AS BETA_COUNT
This displays the count of alpha and beta in the form of a timechart just fine.
I need to lookup a field from a lookup table like this
| lookup gamma_count
This field is a constant
Then I need to display the three stacked in the form of a bar chart, so it looks like this
[alpha_ count] | [beta_ count] | [gamma_count]
Any ideas ?
Any help would be appreciated
Try this:
sourcetype="syslog" | ...
| stats count by range
| append [ inputlookup gamma_count | eval count=gamma_count | eval range="gamma' | fields range count]
I am not quite sure how to get the graph, but this should come close. You may have to play around with the charting options.
Try this:
sourcetype="syslog" | ...
| stats count by range
| append [ inputlookup gamma_count | eval count=gamma_count | eval range="gamma' | fields range count]
I am not quite sure how to get the graph, but this should come close. You may have to play around with the charting options.
sourcetype="syslog" | ...
| timechart count by range
| eval gamma=alpha-beta
should do it. Though you probably want to set the span option on the timechart command.
Thanks much !
Just wondering, what do I do if gamma count is the difference between alpha_count and beta_count (NOT read from a lookup file)
How would i plot that ?
Best regards