Hi, can you post a data sample. I still think the previous lines with that stats and dedup are causing the problem. Just run something like this and post a few lines if possible: ((index=71412-cli sourcetype=show_interface) OR (index=71412-np sourcetype=device_details)) deviceName ="BLV2-TI-SW_WAS18-01" | table deviceId interface deviceName adminStatus   ... View more

Hi @priyastalin, You could do something like this (not tested by the way): (index=71412-cli sourcetype=show_interface) OR (index=71412-np sourcetype=device_details) | stats values(*) as * by deviceId | search deviceName ="BLV2-TI-SW_WAS18-01" | dedup interface | table deviceId interface deviceName adminStatus | sort interface | stats count(interface) as "Total no of ports" count(eval(if(adminStatus="down", interface, null()))) as "Down ports" | eval percDownPorts = ('Down ports' /' Total no of ports' )* 100   Keep an eye on that previous stats and dedup you are performing though and ensure that is not removing valid events for your totals calculations.   Regards, J ... View more

Hi @msrama5, any news on this topic? Can we close it?   ... View more

Hi @msrama5, did you have any chance to review this? If so, did it work for you so that we can close this topic?   Thanks, J ... View more

Hi @msrama5,  Based on the queries you pasted above you could do something like: | union [| search earliest=-3d latest=-2d index=_* OR index=* sourcetype=OPENAPI_STARS_LOGS "Processing AwardStarsRequest complete" *prmen* | fields Star_TranID | rename Star_TranID as starid | eval query=1] [ | search earliest =-4d environment=test8 sourcetype=FEI_Utility Level=Information messagetype=transaction SessionM | eval MessageTemplate=replace(MessageTemplate,"\\\\\"","\"") | spath MessageTemplate | mvexpand MessageTemplate | rex field=MessageTemplate "message\":\"(?<msg>.*)" | search msg="*" | eval _raw=replace(msg,"\\\\\"","\"") | spath | table transaction.sourceTransactionId | rename transaction.sourceTransactionId as starid | eval query=2] [| search earliest =-4d environment=test8 sourcetype=FEI_Utility Level=Information *prmen* messagetype=accrual | spath MessageTemplate | mvexpand MessageTemplate | rex field=field3 "message\":\"(?<msg>.*)" | search msg="*" | eval _raw=replace(msg,"\\\\\"","\"") | spath | table "accrual.sourceTransactionId" | rename "accrual.sourceTransactionId" as starid | eval query=3] | stats values(query) as values, dc(query) as dc by starid | where dc=1 AND values=1   All I did was to merge your queries and run them with union, then last two lines read as: - Group by starid and show me the different values for query (1, 2, 3) and the distinct count of query. - If the distinct count of query is 1 and the value is 1, that particular starid is only present on query 1. You can easily replace that last line to match your logic   Keep in mind I am not reviewing the rest of the code, as all those spath and mvexpand in there could be problematic if the number of events is large. If your time range was the same in all your queries you could avoid the union command and just search across the 3 datasets with the first line, which should be faster to run and won't hit any limits.   ... View more

Hmm, that's interesting. I have tested both your samples on regex101 and my regex works fine with them. Look: https://regex101.com/r/cjjSHZ/1 ... View more