Hi @Rak , at first, check the condition of the presence in both the main searches. Then, if you have the stats command you should have statistics, it's strange if you haven't, did you copied all my...
See more...
Hi @Rak , at first, check the condition of the presence in both the main searches. Then, if you have the stats command you should have statistics, it's strange if you haven't, did you copied all my search, with also the stats command? Otherwise, please try this: (index=testindex OR index=testindex2 source="insertpath" ErrorCodesResponse=PlanInvalid TraceId=*) OR (index=test ("Test SKU"))
| eval type=if(index="test","2","1")
| stats
earliest('@t') AS '@t'
values('@m') AS '@m'
values(RequestPath) AS RequestPath
dc(type) AS type_count
BY TraceId
| where type_count=2
| eval date=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%Y-%m-%d"), time=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%H:%M")
| fields - '@t' Ciao. Giuseppe