Hi All,
I have two searches which shows usage of queues over time on time-chart. When i run each of then separately it works fine. I would like to combine them to show on 1 visualization time-chart for easy comparison. Unfortunatelly i am getting an error.
Single search which works fine:
| mstats avg(_value) prestats=true WHERE metric_name=something* index=something* queue=root.ABC.AB span=5m by queue
| eval queue_level = mvcount(split(queue, "."))
| WHERE queue_level=3
| timechart avg(_value) as "ABC.AB" agg=max limit=5 useother=f span=5m
Combines searches
| mstats avg(_value) prestats=true WHERE metric_name=something* index=something* queue=root.ABC.AB span=5m by queue
| mstats avg(_value1) prestats=true WHERE queue=root.ABC.CD
| eval queue_level = mvcount(split(queue, "."))
| WHERE queue_level1=3
| timechart avg(_value) as "ABC.AB" avg(_value1) as "ABC.CD" agg=max limit=5 useother=f span=5m by queue
Error i get :
Error in 'mstats' command: This command must be the first command of a search.
Booth queues uses the same index, metrics etc.
Any idea about this error / how co fix it ?
Maybe another way how to visualize output ?
Thanks in advance !
:)
↧