Hi Guys, How do I search events that occurred on the last 4 work weeks that starts on Monday and doesn't include the current work week? Let say, I will search for the events today, 23/02 week 8. My search result should only have: week4 - 22/01 to 28/01 week5- 29/01 to 04/02 week6- 05/2 to 11/02 week 7- 12/02 to 18/02 I am using the below query and relative time Earliest: 4 weeks ago, Latest: First Day of this week. On the Earliest, when I select "No Snap-to" -> the week starts on the current day, if I search on Fri the week starts on Fri when I select "First day of the week" -> the day starts on Sunday How can I make it start on Monday? | bin _time span=1w | eval week=strftime(_time,"%V") | stats count as eventscount by _time week Thanks! ... View more

Hi Guys, I need to create a dashboard with the below information. I am having a hard time doing it because the information are coming from 4 different sources. Please help. Thank you. Table: Order-------Planned-----Shipped------Ontime------%Ontime Type 1----------8----------------6--------------- 5------------83.33% Type 2---------10-------------- 10------------- 10---------- 100% Total (1&2)---18---------------16--------------15-----------93.75% Source: Source 1 - Order & Processing Source 2 - Order & Status & Shipped Time Source 3- Order & Type Source 4- Order & required time to ship Req: Planned= count all orders from source 1 with "processing"=ok by "type" from source 3 Finished= count all orders from source 2 with "status"=shipped by "type" from source 3 onTime= count the orders if "shiptime" from source 2 is less than "required ship time" from source 4 by "type" from source 3 %ontime= ontime/shipped Then add the row with total ... View more

Hi guys, With my below query, how can I convert the value of %Empty and %Occupied to Percentage instead of decimal? then add the % sign? Thanks a lot! | chart values(NOOFEMPTYLOCATIONS) AS EMPTY eval(values(NOOFLOCATIONS)-values(NOOFEMPTYLOCATIONS)) as OCCUPIED eval(values(NOOFEMPTYLOCATIONS)/values(NOOFLOCATIONS)) as %EMPTY eval((values(NOOFLOCATIONS)-values(NOOFEMPTYLOCATIONS))/values(NOOFLOCATIONS)) as %OCCUPIED by Aisle ... View more

Hi Guys, I am creating a pie chart with the below query. I renamed and replaced the column and field values. The data it returns on the table are fine but on the visualization it shows the codes "0002", "000E" instead of the "new name". How can I fix it to show the renamed value on the visualization? Thank you. | chart count(INFO) as ITEM_QTY over INFO by BIT_FLAGS | rename "0002" as "CAUTION1", "000E" as "CAUTION1_CAUTION2_ITEMJAM", "000C" as "CAUTION2_ITEMJAM" | replace 080D with REJECT_CLEARING, 080C with OVERFLOW ... View more

Hi Guys, I have 2 queries that I have to combine. I haven't done this before and I'm really struggling. 😞 1st query: coming from 2 sources with the same value of Locations 2nd query: from 3rd source with different data set I used |append to combine the results of my 2 queries but it's not working. Based on my below query, I would like to have this result: Location-------READ---NOREAD--READ% ASRS------------100-------0------------100% Conveyors------100-------0------------100% Sorter------------100-------0------------100% Thank you! index="main" source="FC_READ" OR source="FC_NOREAD" | eval LOCATION=case(like(LOCATIONTEXT,"%RS%"),"RS", like(LOCATIONTEXT,"%Induct%") or like(LOCATIONTEXT,"%Receiving%"),"Conveyors") | chart count(eval(source="FC_READ")) AS READ, count(eval(source="FC_NOREAD")) AS NOREAD by LOCATION | eval "READ%"=round(READ/(READ+NOREAD)*100,2) | append [|makeresults |search source="DEST_MSG" LOCATION=0001 | stats count(eval(BIT=0001 OR BIT=0004 OR BIT=0009)) AS READ count(eval(BIT=0002 )) AS "NOREAD" by LOCATION | eval "READ%"=round(((READ*100)/(READ+NOREAD)),2) | replace "0001" with SORTER] ... View more

Hi guys, I have 2 data sources (source 1 and source 2) with different locations and transactions. How can I group the locations to Inbound and Outbound and count the transactions? Thank you. Source 1 Location Transaction Location/dock/1 ok Location/rec/1 ok Location/pack/1 ok Location/ship/1 ok Source 2 Location Transaction Location/dock/1 not ok Location/rec/1 not ok Location/pack/1 not ok Location/ship/1 not ok Groupings Inbound = Location/dock/1 , Location/rec/1 Outbound = Location/pack/1, Location/ship/1 Result Location Ok not ok Inbound 2 2 Outbound 2 2 ... View more