Hi,
Hi I have 3 searches from 3 different device, I would like to have 1 report which contains data from the 3 devices into 1 line. I am tracking a respondent who started his survey from log in to end of survey. PID and projectID were common fields from all three devices.
Example:
For ProjectID = X and PID=1
He started his online survey; Once he clicked on the link the Gateway-IIS (Gateway is our internal Security system) logs will generate after GatewayIIS the system will generate Gateway logs, but here Gateway can accept/reject the respondent to do the survey. If the gateway reject the respondent we won’t get any other logs. Once the gateway accepted it will go to Web-IIS logs then the survey will start once the survey will start the IVW logs will be generated with the status of Complete, timeout, screenout etc.,
I want to track the respondents from Gateway-IIS to IVW logs.
I want output like
_time---- ProjectID---------PID----Status_Gateway-IIS---StatusGateway---Status_webiis---Status_IVW
20Apr---------X----------------1-----------------Success--------------------Accept-------------200------------Completed
I am using below query but not getting results as expected
index=iis sourcetype=iis host=XY cs_method="GET" | stats values(Status) as Status_Gatewayiis by _time ProjectID PID |sort ProjectID PID |append [search index=Gateway sourcetype=Gateway host=XY | eval A=case(match(_raw, "accept http"), "Accept" , match(_raw," overflow http"), "Reject")|stats values(A) as Status_Gateway by host ProjectID PID kid |sort ProjectID PID kid]|append [search index=iis sourcetype=iis host=ABC cs_method=GET cs_uri_stem="*mriweb.dll*" |stats value(Status) as Status_webiis by ProjectID PID kid |sort 0 ProjectID PID]|append [search index=ibm sourcetype=ivw host=XYZ |stats value(Status) as Status_IVW by ProjectID PID |sort 0 ProjectID PID]
Thanks in advance
↧