HI,
I have two searches per below
index=* host=* source=*
| eval TopicName=split(topicName,".")
| chart sum(size) as Todays_Count over TopicName | sort Todays_Count
| append
[
index=* host=* source=*
| stats count by propertiesTopicName, expectedCount | table propertiesTopicName expectedCount | sort expectedCount
]
Here I am using append which basically appends the result of 2nd search below the first search. I am looking to have it displayed besides one another based on the common field values of "TopicName" and "propertiesTopicName"
Basically end result I want is 3 columns being
propertiesTopicName | Todays_Count | expectedCount
How can I achieve this ? Please help 🙂
It's unclear to me if propertiesTopicName and the multi valued split results from topicName are the same. If so, then why are you not using propertiesTopicName in the first search?
Anyway, the simple answer to what you look like you're trying to do is
index=* host=* source=*
| eval TopicName=split(topicName,".")
| chart sum(size) as Todays_Count over TopicName
| rename TopicName as propertiesTopicName
| append
[
index=* host=* source=*
| stats count by propertiesTopicName, expectedCount
| table propertiesTopicName expectedCount
]
| stats values(*) as * by propertiesTopicName
| sort Todays_Count expectedCount
You will need to resolve how you want the results to be sorted at the end.
But I suspect there is a simpler solution, but would need to understand what your data looks like.
It's unclear to me if propertiesTopicName and the multi valued split results from topicName are the same. If so, then why are you not using propertiesTopicName in the first search?
Anyway, the simple answer to what you look like you're trying to do is
index=* host=* source=*
| eval TopicName=split(topicName,".")
| chart sum(size) as Todays_Count over TopicName
| rename TopicName as propertiesTopicName
| append
[
index=* host=* source=*
| stats count by propertiesTopicName, expectedCount
| table propertiesTopicName expectedCount
]
| stats values(*) as * by propertiesTopicName
| sort Todays_Count expectedCount
You will need to resolve how you want the results to be sorted at the end.
But I suspect there is a simpler solution, but would need to understand what your data looks like.
Thank you! this is exactly what I was looking for 🙂