Объединяя 2 разных поиска в спленке

Question

Поиск 1:

app = "atlas" source = "/ usr / local / homeaway / atlas-production / logs / *" index = "aws_prod_applogs" titan | статистика avg(*responseTime) от date_mday

Поиск 2

app = "atlas" source = "/ usr / local / homeaway / atlas-production / logs / *" index = "aws_prod_applogs" titan statusCode = 200 | статистика avg(*responseTime) от date_mday

Как мне объединить 2 разных поисковых запроса?

Answer 1

Попробуй это:

app="atlas" source="/usr/local/homeaway/atlas-production/logs/*" index="aws_prod_applogs" titan 
| eval result=if(statusCode=200, "Success", "Failure") 
| stats avg(*responseTime) by result, date_mday