topic Re: How to limit instance according to drop down value selected for date filter in Dashboards & Visualizations

How to limit instance according to drop down value selected for date filter

aditsss — Thu, 14 Sep 2023 08:55:10 GMT

Hi Team,

I have below query:

index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCStatus="ebnc event balanced successfully"|dedup EBNCStatus
| table EBNCStatus True

I am deduping my EBNC status so when I am selecting date Filter as yesterday its showing one count but when I am selecting 7 days from date filter still showing one count.

I want when I select 7 its should show 7 count .

Can someone help me with this,

Re: How to limit instance according to drop down value selected for date filter

gcusello — Thu, 14 Sep 2023 09:07:32 GMT

Hi @aditsss,

sorry, but if you use a fixed (for all events) value for EBNCStatus, you'll have always only one value in this field, so when you'll dedup for this field, you'll always have one value!

Could you better describe your requirement?

Ciao.

Giuseppe

Re: How to limit instance according to drop down value selected for date filter

aditsss — Thu, 14 Sep 2023 10:07:26 GMT

@gcusello

Currently when I am doing dedup and selecting last 7 days its showing only event.

I want when I select last 7 days it should show 7 times that message.

when I select last 30 days it should 30 times that message.

Can you help me with this.

Re: How to limit instance according to drop down value selected for date filter

gcusello — Thu, 14 Sep 2023 10:12:24 GMT

Hi @aditsss,

as I said, if you use a fixed (for all events) value for EBNCStatus, you'll have always only one value in this field, so when you'll dedup for this field, you'll always have one value!

try to delete the dedup row and see what happens.

You could try to dedup for the EBNCStatus field and another field (e.g. day), something like this:

index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔",""), EBNCStatus="ebnc event balanced successfully", Day=strftime(_time,"%Y-%m-%d") | dedup EBNCStatus Day | table EBNCStatus True Day

Ciao.

Giuseppe

Re: How to limit instance according to drop down value selected for date filter

aditsss — Thu, 14 Sep 2023 10:28:36 GMT

@gcusello

I have selected last 7 days

but its showing only 2 with below query

index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval
True=if(searchmatch("ebnc event balanced successfully"),"✔",""),
EBNCStatus="ebnc event balanced successfully",
Day=strftime(_time,"%Y-%m-%d")
| dedup EBNCStatus Day
| table EBNCStatus True Day

Re: How to limit instance according to drop down value selected for date filter

aditsss — Thu, 14 Sep 2023 12:10:31 GMT

@gcusello

Can you please guide me on this .

Re: How to limit instance according to drop down value selected for date filter

gcusello — Thu, 14 Sep 2023 12:14:53 GMT

Hi @aditsss,

did you try my last answer?

Ciao.

Giuseppe

Re: How to limit instance according to drop down value selected for date filter

aditsss — Thu, 14 Sep 2023 12:17:28 GMT

@gcusello

yes but with that I am only getting two message

I have selected last 7 days and I am getting only two.

I want if I select last 7 it should show 7 message

when I select yesterday it should show 1 message.

Re: How to limit instance according to drop down value selected for date filter

aditsss — Thu, 14 Sep 2023 12:28:53 GMT

@gcusello

Apologies the query is working but I am getting one additional row .

My query:

search index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day
| table EBNCStatus True Day

Re: How to limit instance according to drop down value selected for date filter

gcusello — Thu, 14 Sep 2023 13:13:58 GMT

Hi @aditsss ,

what's the name of the first column?

if it's "EBNCStatus", put the condition EBNCStatus=* at the end of the search.

Ciao.

Giuseppe

Re: How to limit instance according to drop down value selected for date filter

aditsss — Thu, 14 Sep 2023 14:14:25 GMT

@gcusello

This query is not working for me

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCStatus=*"ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day
| table EBNCStatus True Day

Re: How to limit instance according to drop down value selected for date filter

aditsss — Thu, 14 Sep 2023 14:53:40 GMT

@gcusello

where I need to put this EBNCStatus=*

Below is my query:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day
| table EBNCStatus True Day

Re: How to limit instance according to drop down value selected for date filter

gcusello — Thu, 14 Sep 2023 14:59:37 GMT

Hi @aditsss,

if you don't want the last row with some empty fields, you have to remove empty lines.

You can do it knowing the name of the first column (that I don't know) and poning a rule (if the column is called "column1":

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus=*"ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d") | dedup EBNCStatus Day | search column1=* | table EBNCStatus True Day

Ciao.

Giuseppe

Re: How to limit instance according to drop down value selected for date filter

aditsss — Thu, 14 Sep 2023 16:29:16 GMT

@gcusello

I tried below query

index=abc sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCStatus=*"ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")
| dedup EBNCStatus Day
| search column1=*
| table EBNCStatus True Day

Getting below error

Error in 'EvalCommand': The expression is malformed. An unexpected character is reached at '*"ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")'.

Re: How to limit instance according to drop down value selected for date filter

gcusello — Fri, 15 Sep 2023 06:17:10 GMT

Hi @aditsss,

if you don't want the last row with some empty fields, you have to remove empty lines.

You can do it knowing the name of the first column (that I don't know) and poning a rule (if the column is called "column1":

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔",""), EBNCStatus="ebnc event balanced successfully", Day=strftime(_time,"%Y-%m-%d") | dedup EBNCStatus Day | search column1=* | table EBNCStatus True Day

there is an asterisk outside the quotes in the second eval.

Ciao.

Giuseppe

Re: How to limit instance according to drop down value selected for date filter

aditsss — Tue, 19 Sep 2023 10:28:59 GMT

@gcusello

I tried with below query still one extra row is coming

Re: How to limit instance according to drop down value selected for date filter

gcusello — Tue, 19 Sep 2023 10:38:34 GMT

Hi @aditsss,

if you have an empty field using the table command means that you have incomplete data or that you have a space in that field.

anyway, you can remove them using a different search, e.g. if all the EBNCStatus values starts with "ebnc, you could use

| search EBNCStatus="ebnc*"

Ciao.

Giuseppe

Re: How to limit instance according to drop down value selected for date filter

aditsss — Tue, 19 Sep 2023 12:39:11 GMT

@gcusello

Can you guide me with this query how can I use it

Re: How to limit instance according to drop down value selected for date filter

gcusello — Tue, 19 Sep 2023 13:01:34 GMT

Hi @aditsss,

can you confirm that the values in the field EBNCStatus always starts with "ebnc"?

if yes, please try this:

index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day | search EBNCStatus="ebnc*" | table EBNCStatus True Day

Ciao.

Giuseppe