You need to better explain the desired results by illustrating them in table or elaborate on what "compute stats on totalItems" will do. Do not force volunteers to read your mind. If I must try min...
See more...
You need to better explain the desired results by illustrating them in table or elaborate on what "compute stats on totalItems" will do. Do not force volunteers to read your mind. If I must try mind reading, I speculate that you want a sum of totalItems. This can be achieved with | rename message as _raw
| kv
| stats sum(totalItems) as totalItems by someType Here is an expansion of your mock data to make total meaningful _raw {"cluster_id":"cluster","message":"Excel someType=MY_TYPE totalItems=1 errors=\"ABC, XYZ\" status=success","source":"some_data"} {"cluster_id":"cluster","message":"Excel someType=YOUR_TYPE totalItems=2 errors=\"ABC, XYZ\" status=failure","source":"some_data"} {"cluster_id":"cluster","message":"Excel someType=MY_TYPE totalItems=3 errors=\"AAA, XYZ\" status=questionable","source":"some_data"} Running the above search gives someType totalItems MY_TYPE 4 YOUR_TYPE 2 Is this table about right? You are correct to call out total errors needing to be a separate search. (I mean, you can have them combined if you want to group top error by someType, too.) To do this, however, I have to assume that your developers are nice to you and placed quotes around values of errors. (See the difference between my mock data and yours.) | rename message as _raw
| kv
| stats count by errors
| sort count
| tail 1
| rename errors as topErrors The same expanded, "nicified" mock data would give topErrors count ABC, XYZ 2 This is the emulation to produce the mock data that you can play with and compare with real data | makeresults format=json data="[
{\"cluster_id\":\"cluster\", \"message\":\"Excel someType=MY_TYPE totalItems=1 errors=\\\"ABC, XYZ\\\" status=success\",\"source\":\"some_data\"},
{\"cluster_id\":\"cluster\", \"message\":\"Excel someType=YOUR_TYPE totalItems=2 errors=\\\"ABC, XYZ\\\" status=failure\",\"source\":\"some_data\"},
{\"cluster_id\":\"cluster\", \"message\":\"Excel someType=MY_TYPE totalItems=3 errors=\\\"AAA, XYZ\\\" status=questionable\",\"source\":\"some_data\"}
]"
``` data emulation above ```