I like to take sum the "count" where  "Core Content" field's first 2  max values, Finally divide them by total count. For Example, Core Content Count 4268 2223 4267 1794 4266 305 4265 90 4264 19 4263 63 4262 133 4261 34 4260 26   4768   In this table, I want the below calculation to be implemented using Eval. (2223+1794) / 4768, where 2223 - 1st max value of core content, 1794 - 2nd max value of core content , 4768 - total count. How to calculate this using eval.   ... View more

I ran the below query, index=s sourcetype=S_1 | search Gene="dow" OR Gene="x" OR Gene="ari" OR Gene="lia" OR Gene="SX" OR Gene=z | append [search index=s sourcetype="S_2"|fillnull |eval Gene="rage"] | append [search index=s sourcetype=S_3 |fillnull|eval Gene="ork"] | append [search index=s sourcetype=S_4|fillnull|eval Gene="tat"] | append [search index=s sourcetype=S_5 | fillnull |eval Gene="bas"] | append [search index=s sourcetype=S_6 | fillnull |eval Gene="bas1"] | append [search index=s sourcetype=S_7|fillnull value=""|eval Gene="App"|fields *] |rename Gene as General | stats count by General,"Report" |eventstats sum(*) as sum_* by General |foreach * [eval "Status %"=round((count/sum_count)*100,2)]|rename count as Count |fields - sum_count |chart values("Status %") over "Report" by General |sort "Report" desc I expect the below Result, But I get the below result, where "bas1" and "App" shows together as "OTHER" And it happens after I use the chart command. Anyone can help me out. ... View more

When I click the chart my drilldown down is not working. But when I remove the "|eval AAA=case(like(o,"%Win%"),"Win",like(o,"%Lin%"),"Linux",like(o,"%Missing%"),"Others",like(o,"%So%"),"Sol",like(o,"%AIX%"),"AIX",1=1,"Others")" eval function. It works fine. Can anyone help me with the issue. Below is my code snippet. <table> <title>status</title> <search> <query>index=* sourcetype=*|fillnull value=""|eval AAA=case(like(o,"%Win%"),"Win",like(o,"%Lin%"),"Linux",like(o,"%Missing%"),"Others",like(o,"%So%"),"Sol",like(o,"%AIX%"),"AIX",1=1,"Others")|search $aaa$ | rename status as "Status"|stats count by "Status"|eventstats sum(*) as sum_* |foreach * [eval "%"=round((count/sum_count)*100,2)]|rename count as Count|fields - sum_count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="totalsRow">false</option> <option name="wrap">false</option> <format type="color" field="status"> </format> <drilldown> <link target="_blank">search?q=index=*sourcetype=*|fillnull value=""|eval AAA=case(like(o,"%Win%"),"Win",like(o,"%Lin%"),"Linux",like(o,"%Missing%"),"Others",like(o,"%So%"),"Sol",like(o,"%AIX%"),"AIX",1=1,"Others")|search $aaa$ |rename status as "Status" |search "Status"="$click.value$"|stats count by status,aaa&amp;earliest=-24h@h&amp;latest=now</link> </drilldown> </table> </panel> ... View more

I have 3 different values to be extracted. Please help me in writing rex command here is the field values name="ascd23:deo" name="adcs44.sys.com" name="aswdc-w.foul.com" I need values as below name=ascd23 name=adcs44 name=aswdc-w I need a rex command ... View more