Hi Team, I am wondering if there is any command to to calculate how many times a string consecutive present. for eg :  Here I am trying to pull the letter "C" if the data is "ACDEFCCCXYZ" - output should be "3" if the data is "ACDEFCCXYCCCCZ" - output should be "4"   Not sure what could be possible way to do it. Please assit Thanks ... View more

Hi There, I am looking to produce an output where the field with maximum count is display based on another field. for, eg I am looking something command like  | stats max(count(errors) by status time                                       status             errors                    count 2022-03-02 05:30 100 not found 100 2022-03-02 05:30 200 success 300 2022-03-02 05:30 300 failed 500 2022-03-02 06:30 100 not found 400 2022-03-02 06:30 200 success 500 2022-03-02 06:30 300 failed 600 2022-03-02 07:30 100 not found 200 2022-03-02 07:30 200 success 700 2022-03-02 07:30 300 failed 200   What I am looking for is the max count each status and error time                                       status           errors                    count 2022-03-02 05:30 100 not found 400 2022-03-02 06:30 200 success 700 2022-03-02 07:30 300 failed 600   I tried many thing but with no luck, if someone could help with this. ... View more

Hi There, I have got some results in after running the below command my search |  | bucket _time span=1h | stats count by _time http_status | eventstats sum(count) as totalCount by _time | eval percent=round((count/totalCount),3)*100 | fields - count - totalCount Output is as follows time                                      status                    percent 2022-03-02 05:30:00 100 10.0 2022-03-02 05:30:00 200 30.0 2022-03-02 05:30:00 300 60.0 2022-03-02 06:30:00 100 30.0 2022-03-02 06:30:00 200 60.0 2022-03-02 07:30:00 300 10.0 2022-03-02 07:30:00 100 20.0 2022-03-02 07:30:00 200 30.0 2022-03-02 06:30:00 300 50.0   I am trying to transpose the output as below : time                                     100                        200     300  2022-03-02 05:30:00 10.0 30.0 60.0 2022-03-02 06:30:00 30.0 60.0 10.0 2022-03-02 07:30:00 20.0 30.0 50.0   please assist ... View more

Hi There, I am trying to get the an hourly stats for each status code and get the percentage for each hour per status. Not sure how to get it. my search | | bucket _time span=1h | stats count by _time http_status_code | eventstats sum(count) as totalCount | eval percentage=round((count/totalCount),3)*100 please suggest which command could be helpful here.  thanks ... View more

Hey there, I have a field let's say "abc" with values as such : 1,3,5,7,5,3,2,1,5,7,8,5,1,1,2,2,3,2,1,1,2,3,2,3 here what I am trying to look here is first do a stats count by abc | where count > 2  and then again do a stats dc(abc) by "some other field"   I have tried do to it but unable to get any results not sure if there is any other option to perform it. thanks ... View more

Hi Everyone, So the goal here is to auto increment / decrement a value based on the position of character present in a string. For example : Here I am trying to pull and an assign a value to R This works but only when the "pos" is less than 3. I would like to assign the value for each and every position. Field1 = "RFTGQOASZ"   | makeresults | field1 = "RFTGQOASZ" | eval pos = len(mvindex(split(field1,"R"),0))+1 | eval value = 5 | eval pos1 = if(pos<3,value,0)   likewise the field1 value will change every time, I would like to assign a value based on the position. so let say if the "R" character is in the middle , auto decrement the value, something like i--. ... View more

I need to run three different queries based on the each respective results.  for example : 1) In the first one query : index * search | top result.  so let's say I pick the first result which is "abc" 2) In second query I use the first result and inject it in here index=* search result=abc | top status 3) Use the second result and inject it in the third search index=* search result=abc status=xyz | timechart count by "something"   I am not sure if there is easier way to do it or this would take more time and bandwidth. Any help would be really helpful. Need some guidance here. ... View more

Hey folks, I am trying to pull a result based on chart count by, I am also not sure if there is any other command which can fulfil this result. So the end result what I am looking for is : http.status IN (200,400,403) | chart count by path http.status path.                                    200.                      400                   403 /abc                                     10%                     30%                  60% /xyz                                      20%                    40%                  40% /home                                 35%                    35%                   30% I have checked the community answers but none of them is close to what I am looking for. if someone could just guide and help me through this, that would be really helpful. ... View more