Thanks somesoni2. I see that you're re-iterating your previous search filter, but after I placed it in line with my query, the same results are occurring. This search is specific to a single circuit ID. Below is the query.
index=SILVX | search "765A*O_AISR NOT [| makeresults | eval n=mvrange(2,13) | table n | mvexpand n | eval "SilvxManagerAlarmObject{}.TrapInfo{}.DisplayName"="_".replace("0000".n,"(\d{4})$", "\1") | fields - n | format "" "" "" "OR" "" ""] | timechart count by SilvxManagerAlarmObject{}.TrapInfo{}.DisplayName
Here's a perfect copy of the returned circuit ID:
765A__O_AISR-2_U_B_0001
as seen here, the circuit IDs are identical up to the final string. Some go as high as _0021. All of these are returned in the query above. There is a * in front of my circuit ID above because for unknown reasons, some return with a device PathID-x-x-x initial wording, but should not matter based on the NOT filter constraints above since it is targeting the _0001 ... numbered portion. I hope this helps! Thanks!
... View more