I need to create a report based on three different search criteria from three different sources. But since its a reconciliation report from three different systems, I need to make sure I present it in one report itself.
index=abc host="server-abc*" "upload succeeded" env=prd
index=klm host="server-klm*" "index file" "*_prd.xml"
index=xyz host="server-xyz*" "file uploaded" "Status code : {}200"
The output/report I am trying to achieve is -
Index Count
abc 100
klm 89
xyz 98
Will appreciate your ideas to achieve this.
Try this
( index=abc host="server-abc*" "upload succeeded" env=prd ) OR ( index=klm host="server-klm*" "index file" "*_prd.xml" ) OR (
index=xyz host="server-xyz*" "file uploaded" "Status code : {}200") | stats count by index
Thank tiagofbmm and what if I need to give another name to each index. Like instead of "abc", if I want to show custom name like "Indexer1" and so on?