I have given the query below. I am trying to display all 3 RERs- RERa, RERb, RERc. But this is displaying just RERb and RERc. RERa is not getting displayed. Is there any limitation on appendcols iteration? Or if anyone has some suggestion how I can accomplish what I need.
index=cba_mainframe AND MSGTXT = "*RC=0000*" AND JOBNAME=P6435COY OR JOBNAME=P6435CON|stats count AS total
|appendcols [search
|head 1
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m")
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RERa=case(Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" ,"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0",
Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3) OR (Time1 > Time4 AND Time1 < Time5),"100",
Week_DAY=2 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100",
Week_DAY=2 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0",
Week_DAY=3 AND (Time1 >= Time2 AND Time1 < Time3),"100",
Week_DAY=3 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"100",
Week_DAY=3 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"0",
Week_DAY=4 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%","100",
Week_DAY=4 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0"
)]
|stats values(RERa) as RER1
|appendcols [search index=cba_mainframe AND MSGTXT = "*RC=0000*" AND JOBNAME=P6435SEF OR JOBNAME=P6435SEE
|head 1
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m")
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RERb=case(Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" ,"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0",
Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3) OR (Time1 > Time4 AND Time1 < Time5),"100",
Week_DAY=2 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100",
Week_DAY=2 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0",
Week_DAY=3 AND (Time1 >= Time6 AND Time1 < Time7),"100",
Week_DAY=3 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"100",
Week_DAY=3 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"0",
Week_DAY=4 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%","100",
Week_DAY=4 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0"
)
]|stats values(RERb) AS RER2
|appendcols
[search index=cba_mainframe AND MSGTXT = "*RC=0000*" AND JOBNAME=P6435GEF OR JOBNAME=P6435GEE
|head 1
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m")
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RERc=case(Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" ,"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0",
Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3) OR (Time1 > Time4 AND Time1 < Time5),"100",
Week_DAY=2 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100",
Week_DAY=2 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0",
Week_DAY=3 AND (Time1 >= Time8 AND Time1 < Time9),"100",
Week_DAY=3 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"100",
Week_DAY=3 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"0",
Week_DAY=4 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%","100",
Week_DAY=4 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0"
)
]
|table RER2 RERc RER1
|eval RER=(RERc+RER2+RER1)/3
Give this a try
index=cba_mainframe MSGTXT="*RC=0000*" (JOBNAME="P6435COY" OR JOBNAME="P6435CON") OR (JOBNAME="P6435SEF" OR JOBNAME="P6435SEE") OR (JOBNAME="P6435GEF" OR JOBNAME="P6435GEE")
| eval dedupField=case(JOBNAME="P6435COY" OR JOBNAME="P6435CON", "type1",JOBNAME="P6435SEF" OR JOBNAME="P6435SEE", "type2" , true(), "type3" )
| dedup dedupField
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m")
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RER1=case(dedupField!="type1", null(), Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" ,"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0",
Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3) OR (Time1 > Time4 AND Time1 < Time5),"100",
Week_DAY=2 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100",
Week_DAY=2 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0",
Week_DAY=3 AND (Time1 >= Time2 AND Time1 < Time3),"100",
Week_DAY=3 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"100",
Week_DAY=3 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"0",
Week_DAY=4 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%","100",
Week_DAY=4 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0" )
|eval RER2=case(dedupField!="type2", null(), Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" ,"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0",
Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3) OR (Time1 > Time4 AND Time1 < Time5),"100",
Week_DAY=2 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100",
Week_DAY=2 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0",
Week_DAY=3 AND (Time1 >= Time6 AND Time1 < Time7),"100",
Week_DAY=3 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"100",
Week_DAY=3 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"0",
Week_DAY=4 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%","100",
Week_DAY=4 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0" )
|eval RERc=case(dedupField!="type3", null(), Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" ,"100",
Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0",
Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3) OR (Time1 > Time4 AND Time1 < Time5),"100",
Week_DAY=2 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100",
Week_DAY=2 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0",
Week_DAY=3 AND (Time1 >= Time8 AND Time1 < Time9),"100",
Week_DAY=3 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"100",
Week_DAY=3 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"0",
Week_DAY=4 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%","100",
Week_DAY=4 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0" )
| stats values(RER1) as RER1 values(RER2) as RER2 values(RERc) as RERc
|eval RER=(RERc+RER2+RER1)/3
Why append 3 searches from the same index? You need to join all 3 searches into a single base search with an OR