Hi there! Wondering if anyone can offer some advice on how to combine several searches to create a chart...
I have eight searches which show acceptable and unacceptable outcomes for product orders - an order is OK if certain products are ordered together and not OK if one of the products is left out.
They look a bit like:
index=prodmon source="Orders"
| search (P1_FLAG ="Y", P2_FLAG ="N", P3_FLAG ="Y")
| stats count as "Non-compliant Orders: Combo 1"
index=prodmon source="Orders"
| search (P1_FLAG ="Y", P2_FLAG ="Y", P3_FLAG ="Y")
| stats count as "Compliant Orders: Combo 1"
I'm trying to get a chart that will show a count for each possible outcome:
Non-compliant orders: Combo 1 Compliant Orders: Combo 1 etc
Any ideas? I've been mucking around with rename and as to get a new field for each count to combine into a search, but nothing has really worked out so far...
Thanks in advance,
Andrea :
... View more