2
1st query
ns=mynamespace* app_name=A-api API=GET_INITIAL_DATA NAME=*

2nd query
ns=mynamespace* app_name=B-api API=GET_FINAL_DATA NAME=*

I have the above 2 queries. Each is querying a micro service's logs. But I do not want to call them individually and looking to have a single query. I want to be able to match 1st query against the 2nd query based on name. I am trying to get a % and also total count. Trying to achieve something like the following:

GET_INITIAL_DATA Total count: 10000000
GET_FINAL_DATA count that matched NAME in 1st call : 8000000
Matching call Percentage : 80%
Non Matching call Percentage : 20%

and show that in a chart divided weekly over a 3 month period. Is there a way to do this? I am expecting millions of records thus it would not make sense for me to make the first query, get all the names (millions of em) and then use that data to make second call. Please assist. Thank you.

cubeb
  • 557
  • 1
  • 5
  • 18

1 Answers1

0

You can try the following query and make a transpose to achieve like this 

 GET_INITIAL_DATA Total count: 10000000
GET_FINAL_DATA count that matched NAME in 1st call : 8000000
Matching call Percentage : 80%
Non Matching call Percentage : 20%

Query : 

(ns=mynamespace* app_name=A-api API=GET_INITIAL_DATA NAME=*)  OR (ns=mynamespace* app_name=B-api API=GET_FINAL_DATA NAME=*)
|stats values(API) as Apps_list dc(API) as Apps_no by NAME
|search Apps_list=*GET_INITIAL_DATA*
|eval match=if(Apps_no=2,"Match",null())
|table NAME,Apps_no,match,Apps_list
|stats dc(NAME) as GET_INITIAL_DATA count(match) as GET_FINAL_DATA
|eval Match_call=round((GET_FINAL_DATA/GET_INITIAL_DATA),0)
|eval nonmatch_call=(100-Match_call)."%"
|eval Match_call = Match_call."%"
|rename GET_FINAL_DATA as "GET_INITIAL_DATA Total count" GET_FINAL_DATA as "GET_FINAL_DATA count that matched NAME in 1st call" Match_call as "Matching call Percentage" nonmatch_call as "Non Matching call Percentage"
Lalith
  • 1