Hi, We can try to group all the transaction into the same field so you don't have a column by Process Id ! 🙂 index=my_favorite_index "message.location"="cancelContract" | spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message | mvexpand ResponseMessages | spath input=ResponseMessages | eval Text = if(like(Text,"Transaction%"),"Transaction",Text) | timechart count by Text You should be able to group all the transaction with this query. You can also add some parameters to the timechart function like that | timechart limit=0 useother=false count BY Text , that should return you every error and not combine them under OTHER field. Let me know if it works for you KailA ... View more

HI ! To complete a bit @elpred0 answer, if you are not used to play with sub search, this is a more complete example of what your search should look like. index=yourIndex [|inputlookup sourcetype.csv | fields sourcetype] | your search That should return all the events in yourIndex with the specified sourcetype in sourcetype.csv KailA ... View more

Hello, What do you think about that | makeresults | eval ServerName = "ServerFarmA-1", count=47 | append [| makeresults | eval ServerName = "ServerFarmA-2", count=49] | append [| makeresults | eval ServerName = "ServerFarmB-1", count=16] | append [| makeresults | eval ServerName = "ServerFarmB-2", count=15] | table ServerName,count | rex field=ServerName "^(?<Farm>[^-]+") | stats values(count) as count by Farm | eval FirstServer = mvindex(count,0), SecondServer = mvindex(count,1), Percentage = (FirstServer / SecondServer)*100, State = case(Percentage>=0.95,"Good", Percentage >=0.75,"Needs Attention", true(),"Bad") That give you the percentage by ServerFarm and after you ca you a case to assign the value you want to a percentage range 🙂 Let me know Kail Edit If the count is equal between two server of the same farm | makeresults | eval ServerName = "ServerFarmA-1", count=57 | append [| makeresults | eval ServerName = "ServerFarmA-2", count=47] | append [| makeresults | eval ServerName = "ServerFarmB-1", count=16] | append [| makeresults | eval ServerName = "ServerFarmB-2", count=16] | table ServerName,count | rex field=ServerName "^(?<Farm>[^-]+") | stats list(count) as count by Farm | eval FirstServer = mvindex(count,0), SecondServer = mvindex(count,1), First = case(FirstServer > SecondServer,SecondServer, FirstServer < SecondServer, FirstServer, FirstServer = SecondServer, FirstServer), Second = case(SecondServer > FirstServer,SecondServer, SecondServer < FirstServer, FirstServer, FirstServer = SecondServer, SecondServer), Percentage = (First / Second)*100, State = case(Percentage>=0.95,"Good", Percentage >=0.75,"Needs Attention", true(),"Bad") ... View more

Hello :), You can try something like that : index=foo | stats count by sourcetype | inputlookup append=true srctype.csv | stats count by sourcetype | where count > 1 That should return you the sourcetype present in the index AND in the lookup Let me know. KailA ... View more

Hi, You can use regular expression to check if there is a minus sign or not, and if not, add the plus sign to your percentage. Below a working example : | makeresults | eval temp = split("150%;-97%",";") | mvexpand temp | rex field=temp "^(?<sign>.)" | eval temp = if(sign="-",temp,"+".temp) The first 3 lines are only there to generate example data. Let me know 🙂 KailA ... View more

Hi, Can you try something like that | eventstats sum(Total) as GrandTotal by things | stats values(Total) as Total, values(example) as example values(GrandTotal) as GrandTotal by thing | table thing, example, Total,GrandTotal Doing the sum of the Total before should be a good solution. KailA ... View more

Hi, In the chart option format , in Y-Axis, you can change the scale from Linear to Log. Maybe that could help you with your visualization. You can put 0 in Min Value and 800 for the Max Value Let me know Kail ... View more

Hi, I don't really know how to use map so I will try to provide you a working query with a join . index="Index_Source" sourcetype="Sourcetype_B" SUB | rename Ticket as B_Ticket | eval Main_Ticket_5=substr(B_Ticket,1,5) | table Main_Ticket_5 | join Main_Ticket_5 [ search index="Index_Source" sourcetype="Sourcetype_A" | rename Ticket as A_Ticket | eval Main_Ticket_5 = split(LinkedTicket,",") | mvexpand Main_Ticket_5 | table Main_Ticket_5,A_Ticket] Tell me if it works (hope there is not too much error, I have nothing to test it :p) Also, just remember than a sub-search can produce up to 50 000 events. Kail ... View more