Combining two results from different queries

Comments

3 comments

  • Avatar
    Rick Jury

    You could try something like this example below. 

    (
    "Logging CompanyResponse"
    AND
    _source = "wpb-auth-dev"
    )
    OR
    (
    "(updatePaymentSubmission method) Transaction Succeed"
    "TransactionStatus=SUCCEEDED"
    AND _source = "payments-dev"
    )
    | parse "CompanyId=*," as CompanyId nodrop
    | parse "DefaultMotoProvider=*:" as DefaultMotoProvider nodrop
    | where !(DefaultMotoProvider matches "null" ) and _source = "wpb-auth-dev"

    /* parsing these probably pointless as not used in aggregate??
    | parse "invoiceCurrencyAmount=*," as PaidAmount nodrop
    | parse "invoiceCurrency=*," as Currency nodrop
    | parse "servicerName=*," as Provider nodrop
    | parse "applicationId=*," as ProductId nodrop
    | parse "paymentMethod=*," as PaymentMethod nodrop
    | parse "companyId=*," as CompanyId nodrop
    | where PaymentMethod="card-Moto" nodrop
    */

    | if (_source = "wpb-auth-dev","Companies_Have_Set_Default_Provider","Unique_CompanyIds_Accepted_MotoPayment") as type
    | count_distinct(CompanyId) by type

    0
    Comment actions Permalink
  • Avatar
    Jordi Hoock

    actually this returns only one count which is 

    Companies_Have_Set_Default_Provider

     

    but it doesn't return the 

    Unique_CompanyIds_Accepted_MotoPayment

     

    i think there must be something missing, the one you commented about parsing it is pointless, i guess we need those informations in order to get Unique_CompanyIds_Accepted_MotoPayment

     

    thanks in advance

    0
    Comment actions Permalink
  • Avatar
    Rick Jury

    make sure both parts of the query return results with something like:

    (
    "Logging CompanyResponse"
    AND
    _source = "wpb-auth-dev"
    )
    OR
    (
    "(updatePaymentSubmission method) Transaction Succeed"
    "TransactionStatus=SUCCEEDED"
    AND _source = "payments-dev"
    )
    | count by _source

     

    it may be the 2nd half of the OR is just busted.

     

    The only field you parse and use later is  parse "CompanyId=*," as CompanyId nodrop and for both types of log the parse statement is very similar  so it should parse fine from both.

    you could try changing that to:

    parse "ompanyId=*," as CompanyId nodrop

     

    in case the C vs c matters.

    0
    Comment actions Permalink

Please sign in to leave a comment.