Is there a way to list the "Interesting Fields" sidebar in query and have it drilldown when clicked on? ... View more

I have a basic search that returns multiple results. | stats count by activity ....which returns these results. activity counts Open 24 Closed 2 Conflict 5 Empty 100 Is there a way to create a report or dashboard to show green or red for each respective activity. If there is at least 1 count then red, and if there are no counts per activity then green? ... View more

I have the raw data below. How do I get the strings after the "action": and put all the results into a new field? {"dateTime":"2018-03-19T05:57:46.3002859Z","ID":"b3f7","account":"9002",xd":"859","action":"Exit"} {"dateTime":"2018-03-19T05:57:47.1102859Z","ID":"cbbf","account":"f295",xd":"f89","tile":"HeroTile","action":"page:http://first.com/roomV8.2/front.main/"} {"dateTime":"2018-03-19T05:57:46.3002859Z","ID":"b3f7","account":"9002",xd":"859","action":"Exit"} {"dateTime":"2018-03-19T05:57:47.1102859Z","ID":"cbbf","account":"f295",xd":"f89","tile":"HeroTile","action":"page:http://second.com/roomV8.2/front.main/"} ... View more

How do I take the results of one query and use it in another. I want to take the results of trackedsessions and use it in the tile query. (i.e. tile/trackedsessions) tracked sessions: ....search | eval View=case(like(publishId,"%U"),"unsubscribed",like(publishId,"%S"),"subscribed") | transaction startswith="Enter" endswith="Timeout" or "Exit" by deviceID View | table View deviceID eventcount | stats count(deviceID) as count by View tile: ...search | stats count(tile) as tile, count as trackedsessions | eval percentage=round((tile/trackedsessions*100),2) ... View more

....search | eval View=case(like(publishId,"%U"),"unsubscribed",like(publishId,"%S"),"subscribed") | transaction startswith="Enter" endswith="Exit" by deviceID View maxpause=300s | table View accountExId deviceID action dateTime eventcount duration | stats count(deviceID) as count by View How can I get the transactions that are greater than 300s in duration as well? Is there a way to show the transactions that are greater than 300s as well in one search? ... View more

How would I do this in SPL? I want to calculate a tracking session: Find an ENTER event in the log. Search forward in the log data for events after this event with the same device ID and same account ID. Sort them by date (ascending). Walk through the log events in order, adding them to the session. If any of the following occurs, we stop searching: If the next is more than "session timeout" (default 5 minutes) after the previous event in the session, consider the session terminated. If an EXIT or TIMEOUT event occurs, consider the session terminated. Find the last non-timeout event. Session duration calculation is based on the time difference between the first event and the last non-timeout event. ... View more

...search | stats count(tile) as launches by tile publishId | sort -"launches" accountExId: 12345678 publishId: 63020U or 63020S tile: Tile1 How do I get results so that it will look similiar to this: publishId tile launches *S Tile1 4 Tile2 6 Tile3 8 publishId tile launches *U Tile1 8 Tile2 1 Tile3 10 ... View more

accountId: 12345678 action: Test publishId: 123 or 456 tile: Tile1 How can I get this result: [accountID that has a tile=* value divided by the total number of total accountId's returned sorted by publishId 123 and 456 ]? Not all accountId's will have a tile value. ... View more

I have one index and two sourcetypes. I want to be able to count the actions from sourcetypeA and correlate the data from sourcetypeB. SourcetypeB however is in JSON format. **sourcetypeA:** accountId: 12345678 **action:** Enter assetId: 7a8b9c dateTime: 2018-04-21T20:32:52.295348Z deviceID: abcdefgh **publishId:** 63600U **tile:** Tile1 **sourcetypeB:** dateTime: 2018-04-21T19:44:41.3524516Z **publishId**: 63600U published: { [-] Background: { [+] } Condition: { [+] } EditBy: charlie EditTime: 2018-04-15T19:43:58.1671071Z Id: 6 Info: { [+] } PublishBy: charlie PublishTime: 2018-04-15T19:44:41.3524516Z ScheduleTime: 2018-04-15T19:50:00Z Template: { [+] } Tiles: [ [-] { [+] } { [+] } { [-] Condition: { [+] } Id: 2 **Name:** Tile1 **Subscribed:** { [-] Images: [ [+] ] Live: { [+] } Text: [ [-] Tile1Text ] **TileTypeIndicator**: category } **Unsubscribed**: { [-] Images: [ [+] I'm trying to join (don't know if that is the right word used in SPL?) on "publishId" between the two sourcetypes. Then count the number of "tiles" from sourcetypeA while referencing the related information from sourcetypeB? i.e. Tile1 is Tile1Text, Tile2 is Tile2Text, Tile3 is Tile3Text, etc. sourceytypeA has the data for how many times "tile" is logged. i.e. Tile1 sourcetypeB has the information of what Tile1 is referenced to. i.e. Tile1Text Then sort between subscribed and unsubscribed. | rename published.Tiles{}.Name AS Name, published.Tiles{}.Subscribed.Text{} as Text ... View more