I am running two search queries-
1st to get count of requests received -
"Received Request-ID-->" | rex ">(?\S+) " | eval Application=case(areqstat LIKE "BTMS%","BTMS",areqstat LIKE "EVSN%","EVSN_Application",areqstat LIKE "DFLW%","DFLW_Application",areqstat LIKE "IDAP%", "IDAP Application",areqstat LIKE "ISF%","ISF Application",areqstat LIKE "ROLB%", "ROLB", 1=1, "Other") | stats count by Application
2nd to get count of responses sent -
Response_for_Request="Response sent for request Id" | rex "request Id - (?\S+) " | eval Application=case(areqstat LIKE "BTMS%","BTMS",areqstat LIKE "EVSN%","EVSN_Application",areqstat LIKE "DFLW%","DFLW_Application",areqstat LIKE "IDAP%", "IDAP Application",areqstat LIKE "ISF%","ISF Application",areqstat LIKE "ROLB%", "ROLB", 1=1, "Other") | stats count by Application
I want to plot a single graph where request received vs response sent count can be plotted for same application.
Any suggestion?
... View more