Hi, I am getting number of orders per hour and last week same hour orders and delta percentage. i run this every hour (using basic schedule) to get previous hour orders in an email. Now i want to get cumulative totals. How can we accomplish this in a scheduled search. For example hour1 have below numbers and hour2, it should be total of hour1+hour2. Hour3 it should be Hour1+Hour2+Hour3. Measure Value OrdersLastHour 1181 OrdersLastWeekSameHour 734 OrderDeltaPct 60.90 ... View more

Hi, I am trying to capture all query string names (but not values as a list). I tried the below expression but i think it is capturing only the first one but not the rest. Any help is appreciated rex field=uri "\?(? (?:([^?(?:=.*)&]+)))" Below is an example event. GET /Ntt-valve+Butterfly+Valves,?L1=Butterfly+Valves%25252C&L2=Stainless-Steel&Ndr=textsearchesinbase%252Btrue&operator=prodIndexRefinementSearch&originalValue=valve&sst=All So i need L1 L2 Ndr operator originalValue sst ... View more

Hi, I am trying to get conversion and average order value and i am using eval function to calculate these. But i want to get these by different applications that we have. If i don't use stats i don't know how to get by application. If i use stats what function to use to just get the evaluated values? i tried values but did not work. | stats dc(OrderNumber) as Orders, dc(sessionid) as Visits | eval CVR =(Orders/Visits)*100 | eval Conversion = round(CVR, 1) | eval AOV=(Revenue/Orders) | eval AOV = round(AOV, 1) | stats values(AOV), values(Conversion) by Application ... View more

Hi, I am getting order count today by hour vs last week same day by hour and having a column chart. This works fine most of the times but some times counts are wrong for the sub query. It looks like the counts are being shifted. For example, 9th hour shows 6th hour counts, etc. This does not happpen all the time but don't know why this happens some times. Any idea? sourcetype="access_combined_wcookie" (uri=/submitOrder) earliest=-7d@d latest=-6d@d | stats count as LastWeek by date_hour | appendcols [search sourcetype="access_combined_wcookie" (uri=/submitOrder) earliest=@d latest=now | stats count as Today by date_hour] ... View more

Hi, I am trying to calculate conversion rate using number of orders/visits. Number of visits from one sourcetype and visits are from different source type. So i have used join command. But i am not getting any output sourcetype=XXXXX | stats count(OrderTotal) as Orders | join append[search sourcetype=YYYYY | stats dc(SessionID) as visits] | eval CVR =(Orders/Visits)*100 | table CVR When i take out table CVR i can see that the 2 stats output values separately. But i want to use those and calculate the CVR and just output that value alone. Any help is much appreciated. ... View more

Hi, We have a filed called BOTs which extracts all the legitimate BOTs (which have +http://.... in the user agent). I want to add the other BOTs into the same field which does not follow the standard user agent format (so they won't have +http://.. format). I have a look up table and tried the match_type = WILDCARD(useragent) and then i have in the csv file (Look up file). BOTs useragent Traverse Traverse Capture Capture But i am not getting in the BOTs field. Any suggestions? ... View more