My query , index=s_New sourcetype IN (Compare,Fire) | stats values(*) as * values(sourcetype) as sourcetype by sysid _time | fillnull value="" | eval Status=if(Fire_Agent_Version = "" AND Compare_Agent_Version = "","Not Covered","Covered")  | search OS="*" Group="*" Name="***" Environment="*" | timechart span=1d count by Status | addtotals | eval "Covered %"=round((Covered/Total)*100,2) | eval "Not Covered %"=round(('Not Covered'/Total)*100,2) | fields _time "Covered %" "Not Covered %" The above search not providing expected count as i get i get for Status count  as below , iindex=s_New sourcetype IN (Compare,Fire) | stats values(*) as * values(sourcetype) as sourcetype by sysid  | fillnull value="" | eval Status=if(Fire_Agent_Version = "" AND Compare_Agent_Version = "","Not Covered","Covered")  | search OS="*" Group="*" Name="***" Environment="*" | stats count by Status | eventstats sum(*) as sum_* | foreach * [ eval "Status %"=round((count/sum_count)*100,2)] | rename count as Count | fields - sum_count | sort - Count I think i am missing  something in timechart search .How to get he exact count for timechart as in below search using stats alone.   ... View more

I am using below query, index=A sourcetype IN (Compare,Fire)| fillnull value="" | search Name="*SWZWZQ0001*" OR Name="*SADAPP0002*" OR Name="*SALINU0016*" OR Name="*SGGRNP1002*" | stats values(*) as * by sysid |eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered") | table sourcetype sysid Name F_Agent_Version C_Agent_Version Status   sourcetype ITAM_sysid ITAM Name Fire Agent Version Compare Agent Version Status Compare      Fire 0003fb SALINU0016 32.30. 6.3 Not Covered Compare                    Fire 003fcb SGGRNP1002 29.7   Not Covered Fire 0d456 SADAPP0002 32.3   Covered Compare 0d526 SWZWZQ0001     Not Covered  Due to the null's in the first and second rows (SALINU0016,SGGRNP1002) for Agent_version and Compare Agent Version , i am getting not covered instead of covered.Please let me know ,how to get rid of nulls and make the status Covered . ... View more

Hi, I have 2 sourcetypes with same index like ( index=A sourcetype= compare and index=A sourcetype= Fire) i am doing outer join to get data from both sourcetypes for comparing whether agents are installed in machines in both sourcetypes .How to check a newly added machine in a sourcetype in Sourcetype=Compare and not in Sourcetype=Fire which is a old one.Currently i am not seeing the newly added machines from Compare sourcetype My code : index=A sourcetype=Compare | fillnull value="" | join type=outer Name [ search index=A sourcetype=Fire | fillnull value=""] | table Name Agent         ... View more

Hi, My requirement is to take each week monday data alone for a month in trending chart . This need to be showed for status field ,which will have ( pass,fail,error,deleted) values in it.The individual count of  status to be shown for each week monday for a month. Please let me know how to do this .   ... View more

Hi, I am new to dashboard studio . How to create a drill down from bar chart to a single value chart dynamically in dashboard studio.Bar chart has sourcetypes( Pass,fail,error) counts  in y axis and count in x-axis. The single value chart have to show independent counts of Pass,fail,error upon selection in bar chart.  ... View more

Hi, my regex was like below , search| rex field=_raw "Status=(?<Status>\"\w+\s+\w+\".*?)," |stats count by Status My output is like below , Status                      count  "No Service"           250 Service                      500 but i am in need of output as below , Status                      count  No Service           250 Service                   500 I am in need of status ("No Service") as No Service with double quotes in Output .Please let me know what i am missing here . ... View more