First search:
index=A source="FunctionHandler@*" "ul-ctx-caller-span-id"=null
With this search, I can get several row data with different methods in the field ul-log-data.method, so the table will be:
ul-ctx-head-span-id | ul-log-data.method
------------A-----------|---------------1-------------
------------B-----------|---------------2-------------
------------C-----------|---------------3-------------
------------D-----------|---------------2-------------
Second search:
index=A source="FunctionHandler@*" "ul-ctx-caller-span-id"!=null ul-ctx-head-span-id=1-5D0A0438-736C50A33B81102B75CBA44D
With the field "ul-ctx-head-span-id", second search will return 2 row data with different ul-log-data.function, ul-span-duration, so the table will be:
ul-ctx-head-span-id | ul-log-data.function|ul-span-duration
------------A-----------|---------------get------------- |--------xx-----------
------------A-----------|---------------post--------------|--------xx---------
Please note: the second search depends on the field "ul-ctx-head-span-id" in the result of first search.
Finally, I want get a table like below:
ul-ctx-head-span-id | ul-log-data.method | ul-log-data.function|ul-span-duration
------------A-----------|---------------1-------------|-----------get------------ |--------xx-----------
------------A-----------|---------------1-------------|-----------post---------- |--------xx----------
------------B-----------|---------------2-------------|-----------get------------ |--------xx-----------
------------B-----------|---------------2-------------|-----------post---------- |--------xx----------
------------C-----------|---------------3-------------|-----------get------------ |--------xx-----------
------------C-----------|---------------3-------------|-----------post---------- |--------xx----------
------------D-----------|---------------2-------------|-----------get------------ |--------xx-----------
------------D-----------|---------------2-------------|-----------post---------- |--------xx----------
It means if I get 4 row data in first search, then after join, I need show 8 row data
Forgive my poor English, can someone help on this?
Thanks in advance
... View more