the following is the query including | search AFRoute=$AFRoute_search|s$ sourcetype="omni:ors:voice" $Gucid_token$ $t_ENT_Segment$ "IN THE TARGETING: Routing Target constructed as" | rex field=_raw "vVQ =(?<ENT_VQ>.*?)\'" | rex field=_raw "constructed as:<\/br>(?<Target>.*?)<\/" | eval Target=if(substr(Target,1,34)=="UHC>0 & GovtPrograms>0 & Sales>0 &",substr(Target,35),Target) | eval TargeValidator = Target | rex mode=sed field=TargeValidator "s/(?<var>\w+)\s*(?<comparator>[<>=]+)\s*(?<num>0|[1-9]\d*)//g" | eval VResult = if(match(TargeValidator,"[\d\w]"),"FALSE","TRUE") | where match(VResult,$t_TargetSEValidation|s$) | rex field=_raw "Call Priority is adjusted to (?<Priority>\d{1,3}?)<\/" | eval sid = substr(sid,2,32) | eval id=sid | search ENT_VQ=$t_VQ$ | sort by id,_time asc | streamstats count as SEInx by sid | where SEInx > $skillexpressionLength$ | eval sid=if(SEInx=1,id,null()) | sort 0 -_time | streamstats last(_time) AS end_epoch current=f | eval end_time=strftime(end_epoch, "%Y-%m-%d %H:%M:%S") | eval start_time=strftime(_time, "%Y-%m-%d %H:%M:%S") | eval time_range=start_time." - ".end_time | eval Dura=end_epoch-_time | eval ENT_VQ=if(substr(ENT_VQ,1,26)=="VQ_UHC_GovtPrograms_Sales_",substr(ENT_VQ,27),ENT_VQ) | sort 0 _time | table _time,sid, id,SEInx,Dura,Target,VResult,ENT_VQ,Priority | sort by id,_time asc | join id [ search index="cba_omni" sourcetype="omni:ors:voice" "Call to URS Function FetchConfigsOnDN completed" | rex field=_raw "sid='(?<id>\w{20,40})'" | rex field=_raw "env\\\":\\\"(?<ENV>\w{2,20})\\\"" | search ENV=$t_ENV_SelectedTarget$ | table _time,ENV,id ] | eval sid = substr(sid,24,32) | join id [ search index="cba_omni" source="*ors*" "IN THE ROUTING: ROUTING CODE COMPLETED at Exit_IXN_Deleted" GovtPrograms | rex field=_raw "sid='(?<id>\w{20,40})'" | rex field=_raw "Routed:\\\"(?<Routed>\w{1,5})\\\"" | rex field=_raw "ENT_AfinitiStatus:\\\"(?<AFStatus>\w{2,10})\\\"" | rex field=_raw "ENT_AfinitiRoute:\\\"(?<AFRoute>\w{4,10})\\\"" | rex field=_raw "TargetLoopCnt:(?<TLCnt>\w{1,3})" | search AFRoute=$AFRoute_search|s$ | table _time,id,AFRoute,TLCnt] | eval StartDTM_epoch = relative_time(_time,"-20m") | eval EndDTM_epoch = relative_time(_time,"+20m") | table _time,ENV,sid, id,SEInx,Dura,Target,AFRoute,TLCnt,VResult,ENT_VQ,Priority,StartDTM_epoch,EndDTM_epoch | sort by id,_time asc
... View more