Compare two dql query count value

[biswajit-roy76]

I want to compare two logs count value in dql . How can I achieve that?

[MaciejNeumann]

Hello @biswajit-roy76,

Could you provide more context to your question so our DQL experts can investigate your specific use case?

[mosharref_hossn]

You can "append" the search result for another log source and count at the end. 

Example: 

fetch logs
| filter dt.system.bucket == "infra_logs"
| append [
    fetch logs
    | filter dt.system.bucket == "app_logs" 
  ] 
| summarize count(), by:{dt.system.bucket}

[Tiit_Hallas · Accepted solution]

You could use a countIf aggregation function in DQL summarize command, e.g. : 

fetch logs
| summarize messages=countif(log.source == "/var/log/messages"), syslog=countif(log.source == "/var/log/syslog")
| fieldsAdd syslog_is_larger = syslog > messages