topic Compare two dql query count value in DQL

Compare two dql query count value

biswajit-roy76 — Wed, 24 Jul 2024 06:06:46 GMT

I want to compare two logs count value in dql . How can I achieve that?

Re: Compare two dql query count value

MaciejNeumann — Wed, 20 Nov 2024 09:59:47 GMT

Hello @biswajit-roy76,

Could you provide more context to your question so our DQL experts can investigate your specific use case?

Re: Compare two dql query count value

mosharref_hossn — Wed, 20 Nov 2024 15:48:12 GMT

You can "append" the search result for another log source and count at the end.

Example:

fetch logs | filter dt.system.bucket == "infra_logs" | append [ fetch logs | filter dt.system.bucket == "app_logs" ] | summarize count(), by:{dt.system.bucket}

Re: Compare two dql query count value

Tiit_Hallas — Mon, 25 Nov 2024 10:40:42 GMT

You could use a countIf aggregation function in DQL summarize command, e.g. :

fetch logs | summarize messages=countif(log.source == "/var/log/messages"), syslog=countif(log.source == "/var/log/syslog") | fieldsAdd syslog_is_larger = syslog > messages