I have a list of channels that I want to query, and for each one, I'd like to retrieve the latest value. For example
chan_name=B-1111 | head 1 | table _time, dn
chan_name=B-1112 | head 1 | table _time, dn
chan_name=B-1113 | head 1 | table _time, dn
chan_name=B-1114 | head 1 | table _time, dn
What's the best way to combine this query so that it shows up neatly in a table (and ultimately JSON object)?
You could use stats
:
chan_name=* | stats first(dn),first(_time) by chan_name
Or dedup
:
chan_name=* | dedup chan_name | table _time,dn
To add to Ayn's answers:
You can create a new eventtype using the following query:
chan_name=B-1111 OR chan_name=B-1112 OR chan_name=B-1113 OR chan_name=B-1113
Then pipe the results of this new eventtype to dedup or stats. So the new query would look something like:
eventtype=channel_names | dedup chan_name | table _time,dn
Should you need to modify the list of channel names to include in the query, you can do it at the eventtype level.
You could use stats
:
chan_name=* | stats first(dn),first(_time) by chan_name
Or dedup
:
chan_name=* | dedup chan_name | table _time,dn
chan_name=B-1111 OR chan_name=B-1112 OR. ..
I don't want to do all the chan_names, just an inputted list. Is there a way to do something like
chan_name=['B-1111, B-1112']