Client
Error
Error Results
Error ResultsPrevious week
Percent of Total
PercentDifference
abc
1003
2
0
12.5
0
ab...
See more...
Client
Error
Error Results
Error ResultsPrevious week
Percent of Total
PercentDifference
abc
1003
2
0
12.5
0
abc
1003
3
12.5
0
abc
1013
1
2
342
-50
abc
1027
3
3
5
0
abc
1027
5
xyz
43
zyz
abc
1013
2
zyz
432
et
abc
Total
16
zyds
423
tert
My code is --
| bucket _time span=1w
| stats count as Result by LicenseKey, Error_Code
| eval Client=coalesce(Client,LicenseKey)
| eventstats sum(Result) as Total by Client
| eval PercentOfTotal = round((Result/Total)*100,3)
| sort - _time
| streamstats current=f latest(Result) as Result_Prev by LicenseKey
| eval PercentDifference = round(((Result/Result_Prev)-1)*100,2)
| fillnull value="0"
| append
[ search index=abc sourcetype=yxx source= bff ErrorCode!=0
| `DedupDHI`
| lookup abc LicenseKey OUTPUT Client
| eval Client=coalesce(Client,LicenseKey)
| stats count as Result by Client
| eval ErrorCode="Total", PercentOfTotal=100]
| lookup xyz_ErrorCodes ErrorCode OUTPUT Description
| lookup uyz LicenseKey OUTPUT Client
| eval Client=coalesce(Client,LicenseKey)
| eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update xyz_ErrorCodes")+")", ErrorCode)
| fields Client, Error, Result, PercentOfTotal, PercentDifference, Error results previous week
| sort CustomerName, Error, PercentDifference
Still not able to figure out the duplicate row issue, single row for one each error combined with total.
any suggestions please?