@p_gurav
thanks for you reply but iam not getting exact output when i use append.
query 1:
index=vha_pronto sourcetype=pronto_pil_logs "pinless-product-offers" earliest=-1h@h latest=-0h@h | timechart count as "Total Request" span=5m |appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "updateProntoProdOffers" earliest=-1h@h latest=-0h@h | timechart count as "Total Success" span=5m] | appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "pinless-product-offers" AND "The system is temporarily unavailable" earliest=-1h@h latest=-0h@h | timechart count as "Total failure" span=5m] | eval instanceName="Pinless_SS2_Order" | eval Time=strftime(time,"%Y-%m-%d %H:%M") | eval Platform="Pronto" | eval Application="PIL"| eval instanceTag=instanceName."".Platform."_".Application |table instanceTag Platform Application Time "Total Request" "Total Success" "Total failure" | rename instanceTag AS "#Instance TAG" Time as Timestamp |fillnull
query 2:
index=vha_pronto sourcetype=pronto_pil_logs "siebel-order-details" earliest=-1h@h latest=-0h@h | timechart count as "Total Request" span=5m ] |appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "updateProntoSiebelOrder" earliest=-1h@h latest=-0h@h | timechart count as "Total Success" span=5m] | appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "siebel-order-details" AND "The system is temporarily unavailable" earliest=-1h@h latest=-0h@h | timechart count as "Total failure" span=5m] | eval instanceName="Siebel_VFF_Order_SS2_Order" | eval Time=strftime(time,"%Y-%m-%d %H:%M") | eval Platform="Pronto" | eval Application="PIL"| eval instanceTag=instanceName."".Platform."_".Application |table instanceTag Platform Application Time "Total Request" "Total Success" "Total failure" | rename instanceTag AS "#Instance TAG" Time as Timestamp |fillnull
how can i combine these 2 to produce result as one by one like below:
Siebel_VFF_Order_Pronto_PIL Pronto PIL 1/7/2019 12:55 10 10 0
Pinless_SS2_Order_Pronto_PIL Pronto PIL 1/7/2019 12:00 19 19 0
... View more