How to get the sum of total number of failed items count after excluding Item Not Recognized and Loading for both fields?

[monipinni]

I have two fields body.response.failedItemsCount , body.failedItemsCount , In this I have to filter with two unwanted fields :

"body.response.failedItemsHistory{}.itemName"!="Item Not Recognized" AND "body.response.failedItemsHistory{}.itemName"!="Loading..."

""body.failedItemsHistory{}.itemName"!="Item Not Recognized" AND "body.failedItemsHistory{}.itemName"!="Loading..."

I tried base search:

| spath "body.response.failedItemsHistory{}.itemName" | search "body.response.failedItemsHistory{}.itemName"!="Item Not Recognized" AND "body.response.failedItemsHistory{}.itemName"!="Loading..." OR  "body.failedItemsHistory{}.itemName"!="Item Not Recognized" AND "body.failedItemsHistory{}.itemName"!="Loading..." | stats sum(body.response.failedItemsCount) as sum1 , sum("body.failedItemsCount") as sum2 | eval totalsum = sum1 + sum2

How can I get sum of total sum of failed items count after excluding Item Not Recognized and Loading for both fields?

[vnravikumar · Accepted solution]

Hi @monipinni

Try with

yourquery...| search "body.response.failedItemsHistory.itemName"!="Item Not Recognized" AND "body.response.failedItemsHistory.itemName"!="Loading..." OR "body.failedItemsHistory.itemName"!="Item Not Recognized" AND "body.failedItemsHistory.itemName"!="Loading..."