Calculate a value from two log queries


1 comment

  • Avatar
    Log -o- Music

    Hi Andras,

    Nested IFs

    namespace=ns cluster=we container=project1
    | if( %"log.@m" matches "*About to handle incoming blob*", "Incoming", if(%"log.@m" matches "*successfully handled blob*", "Success", "")) as result
    | where !isEmpty(result)
    | count by result)


    Nesting IF statements is like doing if/then/else. In this case:

    • if %"log.@m" matches the first string, the result field gets the value "Incoming"
    • Else, if it matches the second string, the ratio result gets the value "Success"
    • Else, the ratio result gets an empty value ("")

    Then the count by aggregates values of result by counting each value.
    You could then use something like a circle chart to visualize the repartitions of values ("visual ratio").

    If by ratio, you mean a numerical value, you need to use two separate IF statements and put the result in two different fields, so you can do a sum, then calculate the ratio with a division:

    namespace=ns cluster=we container=project1
    | if(%"log.@m" matches "*About to handle incoming blob*", "Incoming", "") as Incoming
    | if(%"log.@m" matches "*successfully handled blob*", "Success", "") as Success
    | where !isEmpty(Incoming) and !isEmpty(Success)
    | sum(Incoming) as incoming_count, sum(Success) as success_count
    | incoming_count / success_count as ratio


    Hope this helps.


    Comment actions Permalink

Please sign in to leave a comment.