When I run the following query , I am getting data for limited days.
Eg. When I run this query for 1 month ,I didn't get data in stats for last 7 days.
index=dmzwebprod sourcetype=access_combined uri="checkout" host=EU status=200 | eval date_d=strftime(_time,"%Y-%m-%d")|stats count as Checkout by date_d | appendcols [search index=dmzwebprod source=access uri="checkout/orderConfirmation" host=EU status=200 | eval date_d=strftime(_time,"%Y-%m-%d")|stats count as orders by date_d] | eval ConversionRate_OrdersCheckout=(orders/Checkout)*100
Here data is not coming for "orders" field for last 7 days. While I checked in its index ,data is there, just it is not appearing in stats when I ran query for say 1 month time duration.
What should be the possible issue here?
That is weird indeed... However i think you could make your search much more effective (and that might well solve the issue).
What do you think of the following?
index=dmzwebprod sourcetype=access_combined (uri="checkout" OR uri="checkout/orderConfirmation") host=EU status=200
| time chart span=1d count by uri
| rename checkout as Checkout, "checkout/orderConfirmation" as orders
| eval ConversionRate_OrdersCheckout=(orders/Checkout)*100
That is weird indeed... However i think you could make your search much more effective (and that might well solve the issue).
What do you think of the following?
index=dmzwebprod sourcetype=access_combined (uri="checkout" OR uri="checkout/orderConfirmation") host=EU status=200
| time chart span=1d count by uri
| rename checkout as Checkout, "checkout/orderConfirmation" as orders
| eval ConversionRate_OrdersCheckout=(orders/Checkout)*100