I Have Two sourcetypes defined . i need to write a query integrating the two sourcetypes and should get a single result.
i.e for example
Sourcetype="X" | (some logic )|stats avg(duration) as Avgresponsetime1
Sourcetype="Y" | (some logic ) |stats avg(duration) as Avgresponsetime2
Now i need a single Query which gives me the ouput as avgresponsetime of the avg from the previous two reponsetimes..
i have tried like this..but didnt work..
(Sourcetype="X" | (some logic )|stats avg(duration) as Avgresponsetime1) OR ( Sourcetype="Y" | (some logic ) |stats avg(duration) as Avgresponsetime2 ) | eval responsetime=avgresponsetime1+avgresponsetime2 | table responsetime
Please help me on this asap..thanx
You can't put an OR between them because by the time you get to the OR you've already "left" the initial search command and piped it to a number of other commands.
You could use append
for getting results from the two searches and then run stats
on all results:
Sourcetype="X" | (some logic )| append [search Sourcetype="Y" | (some logic )] | stats avg(duration) as responsetime
You can't put an OR between them because by the time you get to the OR you've already "left" the initial search command and piped it to a number of other commands.
You could use append
for getting results from the two searches and then run stats
on all results:
Sourcetype="X" | (some logic )| append [search Sourcetype="Y" | (some logic )] | stats avg(duration) as responsetime