Can you help me with a stats count with different field names?

[jip31]

hello,

I use the two query below

index="x" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" | stats dc(Durée de la dégradation) by "Nom_du_fichier" 

index="x" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" | stats dc(Degradation Time) by "File_Name" 

I need to concatenate these 2 queries because the fields are the same: one is in french and one is in english.

I want to do a stats dc with "Durée de la dégradation" and "Degradation Time" and a by with "Nom_du_fichier" and "File_Name"in the same time

could you help me please???

[renjith_nair · Accepted solution]

@jip31,

Try

index="x" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" 
|eval Degradation_Time=coalesce('Durée de la dégradation','Degradation Time')
|eval File_Name=coalesce(Nom_du_fichier,File_Name)
|stats dc(Degradation_Time) by File_Name

[jip31]

perfect renjith thanks

[FrankVl]

You'll simply need to rename the french fields to have the same name as the english fields, before doing your stats.

[jip31]

thanks franck