Hi I wonder whether someone may be able to help me please. Using an adapted solution from @woodcock I'm using the query below, I'm creating a table as follows: Manage List TOTAL View Payments TOTAL What Do You Think TOTAL Then column headings "1 (HS)", "2 (HS)" etc. index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "Manage List"| contingency tags.path detail.manageList | append [search index=main auditSource=agent-frontend auditType=ExitSurvey |replace /survey With "View Payments" |contingency tags.path detail.viewPayments ] |append [search index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "What Do You Think" |contingency tags.path detail.whatDoYouThink] | rename tags.path TO "Question" | fields Question, 1, 2, 3, 4, 5 | fields - TOTAL | rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)" Could someone tell me please is there a way to remove the "TOTAL" rows. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm trying to change the 'dedup' element of the query below to a stats dc: index=main auditSource=ntc "detail.method"=POST detail.statusCode=204 | dedup tags.path | head 8000 | eval `nino=substr('tags.path',6,9) | table nino _time` I've changed dedup tags.path to stats dc(tags.path) , but when I run the query I'm no longer returning any results. could someone tell me please where I've gone wrong. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm running the query below which works fine. index=main auditSource="iht" auditType=Questionnaire "detail.version"=1 | rename detail.activity AS activity, detail.easytouse AS select, detail.nino AS nino | eval activity=if(activity=="","Not filled",activity) | makemv allowempty=true delim="," activity| mvexpand activity | eval activity = case(activity ==1, "Register", activity==2, "Provide asset information", activity==3, "Provide gift information", activity==4, "Provide debt information", activity==5, "Provide exemption information", activity==6, "Increase Threshold", activity==7, "Check estate report", activity==8, "Declare and submit application", activity==9,"Request clearance", 1=1, activity) | eval select = case(select ==1, "Very easy", select==2,"Easy",select==3,"Neither easy nor difficult",select=4,"Difficult",select==5,"Very difficult",select=="","Not filled") | rex field=nino mode=sed "s/(\S{1})\S{1}/\1X/g" | stats list(activity) as activityList, values(select) as selectList, values(generatedAt) as timeList by nino, generatedAt| fields nino, timeList, activityList, selectList| sort nino, timeList But what I'm trying to do is now group this by the nino field. I've tried changing the final two pipes with this: | stats count by nino | fields nino, timeList, activityList, selectList But the problem is, is that although I can see the nino values, all the other fields are blank i.e. timeList, activityList, selectList I just wondered whether someone may be able to tell me where I've gone wrong please. Many thanks and kind regards Chris ... View more