...ND <=600, "Between 5 & 10 Minutes")
The problem I have is around this part >300 AND <=600, where I would like say where "The value is greater than 300 But Less Than Or Equal to 600"....
Can someone please help me with this.
I have looking for a query so that if count is less than 0 change it to 0, otherwise display actual count.
for example, if the count is -23, the r...
Hello community I am trying to combine two different things and cannot figure out how. I am looking at a certain action and counting how many times this is observed per IP address and day. Then I’m ...
...If I just use the lookup command, I can't use greater than or less than so it returns all the values as an mvfield for private_address, an mvfield for upper_port, and a separate mvfield for l...
...hat I am not interested in rows where the frequency is less than 1,000, is there a way to limit the table so it only shows the rows above 1,000? Would this also improve memory usage?
I have the following criteria from a single event that appears like:
Time Event 11/4/22 4:10:28.000 AM { [-] Total: 6656 srv110: 1002 srv111: 1105 srv112: 1007 srv113: 995 srv114: 1269 sr...
...ndividual query that works for me is
"Model List*" OR "Response Code*"
| transaction traceId startswith="Model List" endswith="Response Code" | eval less_dur=duration | where less_dur > 1
| stats c...
I'm working on a search that evaluates events for a specific index/sourcetype combination; the events reflect SSO information regarding user authentication success as well as applications the user ha...
...iving Date User list(data)
| where isnotnull(mvfilter('list(data)'<3))
| chart count(user) by date
Let say I want to count user who have list(data) that contains number less and only less t...
Hi Guys! It's me again!
A few days ago i was asking how can i eval some fields and get the total from them. Now i want to show those in a table format and for that, i made this search:
index=M...