Hello, I wonder if someone could help me out with a query. I'm trying to compare a value against different point in time, for multiple sources. For some reason, the appendcols seems to be adding columns without matching with another field so if the values come out in a different order (not all datasource report at different times), then the report gets mixed results from different datasources so they don't match. Basically, I need this query to join/group on the actual_data_source field index=bi sourcetype=dbx_bi source=automation earliest=-1h@h latest=@h
| bin _time span=1h
| stats sum(error_percentage) as last_hour_percentage by _time,actual_data_source
| appendcols
[search index=bi sourcetype=dbx_bi source=automation earliest=-169h@h latest=-168h@h
| bin _time as last_week span=1h
| stats sum(error_percentage) as last_week_percentage by last_week,actual_data_source ]
| appendcols
[search index=bi sourcetype=dbx_bi source=automation earliest=-673h@h latest=-672h@h
| bin _time as last_month span=1h
| stats sum(error_percentage) as last_month_percentage by last_month,actual_data_source ]
| eval last_hour=strftime(_time,"%Y-%m-%d %H:%M (%:::z %Z)"),last_week=strftime(last_week,"%Y-%m-%d %H:%M (%:::z %Z)"), last_month=strftime(last_month,"%Y-%m-%d %H:%M (%:::z %Z)"), change=(last_hour_percentage-last_week_percentage)
| search last_hour_percentage>10
| table actual_data_source, last_hour, last_hour_percentage, last_week, last_week_percentage, last_month, last_month_percentage Thanks!
... View more