Good afternoon!
I need to do the following:
1. Using a search result that finds the last timestamp in a certain time interval, add it to another search № 2
index=status beamID=1 | stats latest(statustime)
2. Real-time search:
index = status beamID=1 time = "result of search №1" |
stats count(eval(terminalStatus="normal")) as NORMAL count(eval(terminalStatus="critical")) as CRITICAL count(eval(terminalStatus="pending-registration")) as PENDING-REGISTRATION count(eval(terminalStatus="unknown")) as UNKNOWN count(eval(terminalStatus="minor")) as MINOR count(eval(terminalStatus="major")) as MAJOR count(eval(terminalStatus="activationFailed")) as ACTIVATIONFAILED by beamID
Is it possible to do this?
Thanks in advance!
Use a subsearch.
index = status beamID=1 time = [ index=status beamID=1 | stats latest(statustime) as latest | return $latest ] |
stats count(eval(terminalStatus="normal")) as NORMAL count(eval(terminalStatus="critical")) as CRITICAL count(eval(terminalStatus="pending-registration")) as PENDING-REGISTRATION count(eval(terminalStatus="unknown")) as UNKNOWN count(eval(terminalStatus="minor")) as MINOR count(eval(terminalStatus="major")) as MAJOR count(eval(terminalStatus="activationFailed")) as ACTIVATIONFAILED by beamID
Use a subsearch.
index = status beamID=1 time = [ index=status beamID=1 | stats latest(statustime) as latest | return $latest ] |
stats count(eval(terminalStatus="normal")) as NORMAL count(eval(terminalStatus="critical")) as CRITICAL count(eval(terminalStatus="pending-registration")) as PENDING-REGISTRATION count(eval(terminalStatus="unknown")) as UNKNOWN count(eval(terminalStatus="minor")) as MINOR count(eval(terminalStatus="major")) as MAJOR count(eval(terminalStatus="activationFailed")) as ACTIVATIONFAILED by beamID
Thanks! It really works.
@krylov If your problem is resolved, please accept the answer to help future readers.