{"id":52976,"date":"2022-03-18T15:37:10","date_gmt":"2022-03-18T15:37:10","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=52976"},"modified":"2022-03-18T15:37:10","modified_gmt":"2022-03-18T15:37:10","slug":"answer-by-warren-for-multisearch-not-doing-what-i-expect","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=52976","title":{"rendered":"Answer by warren for Multisearch not doing what I expect"},"content":{"rendered":"<p>First, I think what you&#8217;re looking for is the <em>value<\/em> of <code>site<\/code> to match <code>request_type<\/code> (in the initial <code>multisearch<\/code> <code>search<\/code> line) &#8211; but what you&#8217;re <em>actually<\/em> checking for in the <code>where<\/code> clause is whether the <em>text<\/em> <code>&quot;site&quot;<\/code> equals the <em>text<\/em> <code>&quot;request_type&quot;<\/code>. And, of course, that is not the case!<\/p>\n<p>Start by removing the second line of the <code>multisearch<\/code> (since comparing <code>site<\/code> to <code>site<\/code> will <em>always<\/em> be true), and using <code>upper()<\/code> and <code>match()<\/code>:<\/p>\n<pre><code>index=cloud_aws namespace=cloudship lambda=SCScloudshipStepFunctionStats metric_type=*_v0.3 \n| spath input=message \n| multisearch \n    [search request_type=&quot;*&quot; site=*\n    | eval request_type=upper(request_type), site=upper(site)\n    | where &quot;site&quot; == &quot;request_type&quot; ]\n    [search request_type=&quot;*&quot; site=&quot;RTP&quot; zone=&quot;*&quot; \n    | eval zone=upper(zone), site=upper(site)\n    | where match(site,zone)] \n    [search scope=site request_type=&quot;*&quot; site=&quot;RTP&quot; zone=&quot;*&quot; cluster=&quot;*&quot; \n<\/code><\/pre>\n<p>it would be even easier to do <code>cluster=&quot;rtp&quot;<\/code> instead of <code>cluster=*<\/code> here, but I&#8217;ve left the idiom of <code>upper()<\/code>ing and <code>match()<\/code>ing for reading consistency<\/p>\n<pre><code>    | where match(site,cluster)] \n| timechart cont=FALSE span=hour sum(success) by request_type\n<\/code><\/pre>\n<p>from User warren &#8211; Stack Overflow https:\/\/stackoverflow.com\/questions\/71527141\/multisearch-not-doing-what-i-expect\/71529474#71529474<br \/>\nvia <a href=\"https:\/\/ifttt.com\/?ref=da&#038;site=wordpress\">IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>First, I think what you&#8217;re looking for is the value of site to match request_type (in the initial multisearch search line) &#8211; but what you&#8217;re actually checking for in the where clause is whether the text &quot;site&quot; equals the text &quot;request_type&quot;. And, of course, that is not the case! Start by removing the second line &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=52976\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">Answer by warren for Multisearch not doing what I expect<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-52976","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/52976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=52976"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/52976\/revisions"}],"predecessor-version":[{"id":52977,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/52976\/revisions\/52977"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=52976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=52976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=52976"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=52976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}