Here is my index structure: type, from_host, to_host, times
The "type" field can be either "error" or "valid".
I would like to display distinct lines in Timelion corresponding to top 5 "from_host" keywords, and the y value should equals to the sum of "times" field of "type=valid" lines minus the sum of "times" field of "type=valid" lines for the selected "from_host" of this split.
I have tried this without success:
.es(split=from_host.keyword:5, metric=sum:times, q=type:valid).subtract(.es(metric=sum:times, q=type:error))
The problem here is that the
from_host that is selected in the first
.es() query is not naturally injected in the second one, so the
sum is done on all
from_hosts in the second
Is it possible to do this, and if yes, how?