I have 2 searches separately, how can i combine those to fetch results one by one in statistics tab.like mentioned below.
siebel-order-details 1/7/2019 12:55 10
pinless-product-offers 1/7/2019 12:00 19
index=vha_pronto
sourcetype=pronto_pil_logs
"pinless-product-offers" earliest=-1h@h latest=-0h@h |
timechart count as "Total Request" span=5m
index=vha_pronto
sourcetype=pronto_pil_logs
"siebel-order-details" earliest=-1h@h latest=-0h@h |
timechart count as "Total Request" span=5m
You can combine the two like this:
earliest=-1h@h latest=-0h@h index=vha_pronto sourcetype=pronto_pil_logs ("pinless-product-offers" OR "siebel-order-details")
| eval class = case(searchmatch("pinless-product-offers"), "pinless", searchmatch("siebel-order-details"), "siebel", true(), "wtf")
| timechart span=5m count by class
This will search for both types of events, classify them [priority given to pinless here, in case an event contains both strings], and count each class of events over time, giving you two value columns / coloured lines in your chart.
Relying on just strings contained in your event is often okay, but I recommend using a field that contains the type of product offer you are looking for, and splitting the timechart by that field. Then you won't have to re-classify manually in every search. If you had such a field the search would look like this:
earliest=-1h@h latest=-0h@h index=vha_pronto sourcetype=pronto_pil_logs (product_category="pinless-product-offers" OR product_category="siebel-order-details")
| timechart span=5m count by product_category
Try append
command:
index=vha_pronto
sourcetype=pronto_pil_logs
"pinless-product-offers" earliest=-1h@h latest=-0h@h |
timechart count as "Total Request" span=5m | append [ search index=vha_pronto
sourcetype=pronto_pil_logs
"siebel-order-details" earliest=-1h@h latest=-0h@h |
timechart count as "Total Request" span=5m ]
@p_gurav
thanks for you reply but iam not getting exact output when i use append.
query 1:
index=vha_pronto sourcetype=pronto_pil_logs "pinless-product-offers" earliest=-1h@h latest=-0h@h | timechart count as "Total Request" span=5m |appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "updateProntoProdOffers" earliest=-1h@h latest=-0h@h | timechart count as "Total Success" span=5m] | appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "pinless-product-offers" AND "The system is temporarily unavailable" earliest=-1h@h latest=-0h@h | timechart count as "Total failure" span=5m] | eval instanceName="Pinless_SS2_Order" | eval Time=strftime(time,"%Y-%m-%d %H:%M") | eval Platform="Pronto" | eval Application="PIL"| eval instanceTag=instanceName."".Platform."_".Application |table instanceTag Platform Application Time "Total Request" "Total Success" "Total failure" | rename instanceTag AS "#Instance TAG" Time as Timestamp |fillnull
query 2:
index=vha_pronto sourcetype=pronto_pil_logs "siebel-order-details" earliest=-1h@h latest=-0h@h | timechart count as "Total Request" span=5m ] |appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "updateProntoSiebelOrder" earliest=-1h@h latest=-0h@h | timechart count as "Total Success" span=5m] | appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "siebel-order-details" AND "The system is temporarily unavailable" earliest=-1h@h latest=-0h@h | timechart count as "Total failure" span=5m] | eval instanceName="Siebel_VFF_Order_SS2_Order" | eval Time=strftime(time,"%Y-%m-%d %H:%M") | eval Platform="Pronto" | eval Application="PIL"| eval instanceTag=instanceName."".Platform."_".Application |table instanceTag Platform Application Time "Total Request" "Total Success" "Total failure" | rename instanceTag AS "#Instance TAG" Time as Timestamp |fillnull
how can i combine these 2 to produce result as one by one like below:
Siebel_VFF_Order_Pronto_PIL Pronto PIL 1/7/2019 12:55 10 10 0
Pinless_SS2_Order_Pronto_PIL Pronto PIL 1/7/2019 12:00 19 19 0