I'm trying to use a saved, scheduled and accelerated report to produce multiple results and compare the totals.
We log customer Login events with a ton of data. Browser, OS, Username, Customer, UniqueID, timestamp, etc. We are trying to communicate to users who login using IE that we will no longer support the browser going forward. I have created a saved search of "Login Success (Raw)" that has a stats table with the fields:
What I'm trying to do
I want to use these results to see how many logins there are with IE for a customer and compare those to the total logins of all browsers for that customer on the same row all using the same search results.
The resulting table would look like this:
OBID, District, School, Logins, IELogins, %
Here's what I tried but doesn't work
|savedsearch "Login Success (Raw)" | stats count as Logins by OBID District_Name STATE ua_family | join [|savedsearch "Login Success (Raw)" | search ua_family=IE |stats count as IELogins by OBID District_Name STATE ua_family]| rename percent as "%" | eval percent=round((100*IELogins)/Logins,0) | table OBID, District_Name, STATE, IELogins, Logins, %
Currently gives me the error of "Error in 'SearchParser': Found circular dependency when expanding savedsearch=Login Success (Raw)"