I need to create a report based on three different search criteria from three different sources. But since its a reconciliation report from three different systems, I need to make sure I present it in one report itself.
index=abc host="server-abc*" "upload succeeded" env=prd
index=klm host="server-klm*" "index file" "*_prd.xml"
index=xyz host="server-xyz*" "file uploaded" "Status code : {}200"
The output/report I am trying to achieve is -
Index Count
abc 100
klm 89
xyz 98
Will appreciate your ideas to achieve this.
(index=abc host="server-abc*" "upload succeeded" env=prd) OR
(index=klm host="server-klm*" "index file" "*_prd.xml") OR
(index=xyz host="server-xyz*" "file uploaded" "Status code : {}200")
| stats count by index