Hi, I wonder whether someone can help me please. I've written the following query: `wso2_wmf(RequestCompleted)`detail.Context=*test "detail.method"=GET OR "detail.method"=POST tags.path="/payments" OR tags.path="/obligations" OR tags.path="/liabilities" OR tags.path="/returns" OR request.tags.path="/returns" | replace "organisations/*" with * in detail.Context | dedup eventId date_mday | eval end_obligations=case('tags.path' like "%obligations%", 1), end_liabilities=case('tags.path' like "%liabilities%", 1), end_payments=case('tags.path' like "%payments%", 1), end_retrieve=case('tags.path' like "%returns/%", 1), end_submit=case('tags.path' like "%returns", 1) | rename applicationProductionClientId as ClientID | fillnull value=0 | eval newtime=strftime(_time,"%B") | stats sum(end_obligations) as obligations sum(end_liabilities) as liabilities sum(end_payments) as payments sum(end_retrieve) as retrieve sum(end_submit) as submit by newtime ClientID This produces the following output: newtime ClientID obligations liabilities payments retrieve submit February 1234 1 3 5 4 3 February 5675 1 10 2 2 5 January 7890 3 2 2 2 2 But I'd like to produce the following: ClientID obligations liabilities payments retrieve submit 1234 1 3 5 4 3 5675 1 10 2 2 5 February Total 2 13 7 6 8 7890 3 2 2 2 2 January Total 3 2 2 2 2 I've tried using Streamstats, addcoltotals, and although I think I'm close I can't get this to create the desired output. Could someone perhaps have a look at this please and offer some guidance on where I've gone wrong. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone can help me please. I've put together the following query... w2_wmf(RequestCompleted)`request.detail.Context="*test" | dedup eventId | rename request.ClientId as ClientID | stats count(eval('detail.statusCode')) as "All", sum(eval('detail.statusCode'<=303)) as "Successful", sum(eval('detail.statusCode'>303)) as "Unsuccessful" by ClientID ...which outputs as follows: ClientID All Successful Unsuccessful 1111111 3 2 1 What I'd like to do is to expand this and then show all the status codes as column headings after the "Unsuccessful" column heading with the respective counts, but for the life of me, I can't find the solution. Could someone possible look into this and offer some guidance on how I may be able to do this? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the following stats query. `wso2_wmf(RequestCompleted)` | dedup eventId | stats count by request.detailContext The problem I have is that it's not displaying zero values for the request.detail.Context field. If I use '| fillnull value=0' then specify each value from the request.detail.Context field then it does display those values with a zero count. But the problem with this, is that because I'm being prescriptive in field values, when new field values are being ingested into Splunk for this field, they are not being extracted in the stats table. I've looked at every post I could find of a similar nature and the solutions provided haven't worked. Could someone perhaps have a look at this and offer some guidance on how I may go about achieving this. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I've created a Summary Index and populated it with the following search: ( wso2_wmf(RequestCompleted) ) OR ( auth_wmf(RequestReceived) ) | fields _time request.detail.apiContext detail.responseMessage response.detail.statusCode request.tags.path request.detail.applicationProductionClientId request.tags.X-Request-ID tags.X-Request-ID detail.agentCode | collect index=summary_dg_dda marker="report=ddatestV2" The ingestion of the data is working fine and I can see all the events and the fields within the JSON file, but none of the 'fields' are shown as 'explicit' and so I'm unable to extract data using a normal 'stats by' query. Could someone tell me please where I've gone wrong. Many thanks and kind regards Chris ... View more

HI, I wonder whether someone can help me please. I'm running the query below which works fine, but I'm having some difficulty with the formatting. ( wso2_wmf(RequestCompleted) ) OR ( auth_wmf(RequestReceived) ) | spath output=afin input=detail.responseMessage path=affinityGroup | eval requestid=coalesce('request.tags.X-Request-ID', 'tags.X-Request-ID') | stats values(afin) as afin, values(request.detail.apiContext) as api by requestid | search (api="benefits" OR api="employment" OR api="income") | stats count by afin, api | transpose header_field=api I'd like the output to be as per the enclosed screenshot. So the "api" field is row1, the "afin" field is row 2 with the metrics at row 3. I'm able to transpose the "api" data to column headers but I can't find a way to create a secondary set of column headers using the "afin" data. Could someone possibly look at this please and offer some guidance on how I may go about achieving this. Many thanks and kind regards Chris ... View more