I have below data ` { [-] context: { [+] } level: INFO logger: x.x.x.xxx.service.xxxService msg: Filtered statements for account XXXXX: DocumentReferences[references=[DocumentReference[reference=0000001,name=XXXXX_2019,mimeType=APPLICATION_PDF,documentType=ANNUAL_STATEMENT,creationDate=2019-11-18T13:37:13.000Z], DocumentReference[reference=0000002,name=XXXXX_2018,mimeType=APPLICATION_PDF,documentType=ANNUAL_STATEMENT,creationDate=2019-12-03T10:54:47.000Z], DocumentReference[reference=0000003,name=XXXXX_2017,mimeType=APPLICATION_PDF,documentType=ANNUAL_STATEMENT,creationDate=2019-12-03T11:00:52.000Z]]] } ` I want to search more than one ANNUAL_STATEMENT occurrence . As above data have 3 statement then this result should return in table ... View more

I needs to apply left outer join or NOT IN condition on two different search search 1 : index=abc host="xxx" sourcetype=access_combined_wcookie NOT (sessionId="-" OR isnull(sessionId)) method=GET uri_path="/x/y/z*" | rex field=uri "^(?:[^/\n]*/){4}(?P\d+)" | eval pk=sessionId+CTM | dedup pk | table pk Search 2: index=def sourcetype=referral_activity APPOINTMENT_BOOKING_BOOKED | eval pk =substr(session_id, 9)+ctm | table pk | join type=inner pk [search index=abc host="xxx" sourcetype=access_combined_wcookie NOT (sessionId="-" OR isnull(sessionId)) method=POST uri_path="/x/y/w*" | rex field=uri "^(?:[^/\n]*/){4}(?P\d+)" | eval pk=sessionId+CTM | dedup pk | table pk ] Expected results : Unique pk values from search 1 which is not present into search 2 results Please advise.. ... View more

I wants to append multiple search results in separate columns. The following searches are fetched from different source types. Search 1. .......uri_path="/landing/view/*" method=POST | stats dc(sessionId) as A by date_month Search 2. ......."REBOOKED_ACTIONED" | stats dc(session_id) as B by date_month Search 3. .......uri_path="/cancel/confirmed/*" method=POST | stats dc(sessionId) as C by date_month Expected Result in the following format: Date_Month A B C pec_B pec_C JAN-2016 20 10 2 (10*100)/A=50% 10% DEC-2015 40 30 5 75% 12.5% Please advise.. ... View more

Hello This is my data: 2015-07-24 12:18:05 A=10 B=20 C=30 D=15 2015-07-24 12:18:15 A=20 B=210 C=320 D=150 2015-07-24 12:18:25 A=20 B=210 C=320 D=150 2015-07-24 12:18:35 A=20 B=10 C=30 D=50 I am able to show total in the last row with following search: index = "localindex" source = "/var/log/localtest.log" | table Column A,B,C,D | addtotals col=t labelfield=Column label=" TOTALS" fieldname="SUM" I need to show PERCENTAGE in the last row of the table. The value should like (sum(A)/sum(A+B+C+D))*100 and this calculation needs to repeat for each column A, B, C, D, and also include the SUM. Please suggest me how I can do that. ... View more