Adding two aggregated fields


1 comment

  • Avatar
    Bugra Sitemkar

    Here is the solution I have found in case anyone needs it.

    _source="source" and _collector="collector"
    | parse regex "Finished cataloging (?<DiscoverCountOld>\d+) visits for state " nodrop
    | parse regex "Finished cataloging visits: Visit count: (?<DiscoverCount>\d+)" nodrop
    | parse regex "Finished submitting (?<SubmitCount>\d+) visits for state CO" nodrop
    | parse regex "Finished updating status for (?<UpdateCount>\d+) visits for state CO"
    | timeslice 1d
    | sum(DiscoverCountOld) as VisitsDiscoveredOld,sum(DiscoverCount) as VisitsDiscoveredNew, sum(SubmitCount) as VisitsSubmitted, sum(UpdateCount) as VisitsUpdated group by _timeslice
    | VisitsDiscoveredOld+VisitsDiscoveredNew as VisitsDiscovered
    | fields _timeslice,VisitsDiscovered,VisitsSubmitted,VisitsUpdated
    | fillmissing timeslice(1d)
    | sort by _timeslice asc

    Comment actions Permalink

Please sign in to leave a comment.