I am looking at an XML response from an API that contains an array of messages. I want to timechart the messages for a dashboard so we can see the count of each type of error message over time.
What is tripping me up is that sometimes a message in one response type can be included in another response type ( in addtion to other messages) and I am having a hard time separating them into distinct columns in the time chart
index=best_index_ever "message.location"="cancelContract"
| spath input=message.data.responseBody output=ResponseMessages
path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
| mvexpand ResponseMessages
| spath input=ResponseMessages
| eval Text = case( like(Text,"%Cannot Cancel Contract.%") AND NOT like(Text,"Transaction%"),"Cannot Cancel Contract",
like(Text,"Transaction%"),"Transaction Deadlock",
1=1,Text
)
| timechart limit=0 useother=false count by Text
That is what I have so far. I tried using a case with an eval, but that does not work. It still lumps the responses with a message "Transaction...deadlocked" into the "Cannot Cancel Contract" column as well as includes them in the "Transaction...deadlocked" column.
Here is an example of the XML array of messages.
Response example 1:
<Messages>
<Message>
<Type>1</Type>
<Code/>
<Text>Transaction (Process ID 75) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.</Text>
</Message>
<Message>
<Type>1</Type>
<Code>SAVEFAIL</Code>
<Text>Cannot save record.</Text>
</Message>
<Message>
<Type>1</Type>
<Code>CONTRACT_CANCEL_FAIL</Code>
<Text>Cannot Cancel Contract.</Text>
</Message>
</Messages>
Response example 2:
<Messages>
<Message>
<Type>1</Type>
<Code>CONTRACT_CANCEL_FAIL</Code>
<Text>Cannot Cancel Contract.</Text>
</Message>
</Messages>
You'll see that the Cannot Cancel Contract message is in both responses, but the first response also contains two other messages. I am trying to have the timechart represent responses that only contain the "Cannot Cancel Contract" message as mutually exclusive of the messages that contain "Cannot Cancel Contract" + other messages.
... View more