Hi I was been trying hard to extract the following data into a table with the column names failedTestCases(failedScenarios), nameOfTheTestScenario(name), passedTestCases(passedScenarios). And wanted to have a column with successPercent and FailurePercent for each of the test scenario. Example Data: { e2eresult: { features: [ { failedScenarios: 0 name: TPAS Activation scenario with Port In[mocked] passedScenarios: 2 }, { failedScenarios: 0 name: TPAS Activation scenario[mocked] passedScenarios: 4 }, { failedScenarios: 0 name: TPAS Add A Line scenario[mocked] passedScenarios: 6 }, {}, {} ] project: test - automation status: Passed } } Here is what I have done something,  index=duck source=/var/log/containers/**.log | search "e2eresult" | eval _raw="{\"e2eresult\": [{\"features\":[{\"failedScenarios\":\"0\",\"name\":\"TPAS Activation scenario with Port In [mocked]\",\"passedScenarios\":2},{\"failedScenarios\":\"0\",\"name\":\"TPAS Activation scenario [mocked]\",\"passedScenarios\":4}]}]}" | eval all_fields=mvzip('e2eresult.features{}.failedScenarios', 'e2eresult.features{}.name', 'e2eresult.features{}.passedScenarios', ",") | fields all_fields | mvexpand all_fields | makemv delim="," all_fields | eval failedTestCases=mvindex(all_fields, 0) | eval nameOfTheTestScenario=mvindex(all_fields, 1) | eval passedTestCases=mvindex(all_fields, 2) | table failedTestCases, nameOfTheTestScenario, passedTestCases ... View more

Hi, I Have a table-1 with tracking IDs ex: 123, 456, 789 and the other query which returns a table-2 with tracking ID's ex: 456, 789 . Now, I need a query which gives me a table-3 with the values which are not present in table-2 when compared with the table -1 . I tried something like this. source=service1.log earliest=-4h latest=now() | rex field=_raw "trackingId\":\s\"(?[\w-]+)\"" | table ProducerTrackingID | search NOT [search source=service2.log earliest=-4h latest=now() | rex field=_raw "trackingId\":\s\"(?[\w-]+)\"" | table ConsumerTrackingID] Can you please explain me the query. And Thanks a lot in advance. ... View more