Hi : I want a table something like : API Code Count Total API1 404 2 11 500 3 303 6 API2 404 4 14 500 10 my query is : index=apigee sourcetype=facade channelId=* responseStatusCode>"399" | eval API=case(match(Referer,"./abc$") , "API1" , match(Referer,"./xyz$") , "API2" , match(Referer,".*/uvw$") , "API3") , response_failed=case(responseStatusCode>"399","failed")|stats values(responseStatusCode) as "Code" , count(responseStatusCode) as "Count",count(response_failed) as "Total" by API I want separate count for values of responsetatusCode. but currently I am getting : API Code Count Total API1 404 11 11 500 303 API2 404 14 14 500 ... View more

Hi, I want to use the result of one search, and then use this result in another search to put it in the same chart. This thing needs to be done for 6 results and I want to display this on a chart. I don't want to use to join as it takes forever to give the desired result. I tried using eval case and match, but I am unable to use join in that search. My search is exactly the same for all the searches except the fields referer and proxyurl. Again, appendcols sometimes mess up with timeinterval giving wrong results for duration greater than 30days. My search looks: sourcetype=*index* Referer="*/prepaid/cart/orderreview" AND proxyURL="*/payment/v1/orders/payment-method" AND http_method="POST" result=* channel_id=* | join session_id[search (Referer="*/prepaid/accessories" AND proxyURL="*/purchase-path-browse/v1/available-offers" http_method="POST") result=*| table session_id] | rex field=Referer "http?:\/\/(?[^/]+)" | eval ENV=case(DOMAIN LIKE "%preqat%", "PREQAT", DOMAIN LIKE "%qat%", "QAT",DOMAIN LIKE "%preprod%","PREPROD") | search ENV =* |eval Referer="Purchase Accessories" |timechart span=1d count(eval(responseStatusCode="200")) as "Successful Transactions" by Referer | appendcols[ search sourcetype=*index* Referer="*/prepaid/cart/orderpayment?cartId*" AND proxyURL="*/payment/v1/orders/payment-method" AND http_method="POST" result=* channel_id=* | join session_id[search (Referer="*/prepaid/browse-devices" AND proxyURL="*/purchase-path-browse/v1/available-offers" http_method="POST") result=*| table session_id] | rex field=Referer "http?:\/\/(?[^/]+)" | eval ENV=case(DOMAIN LIKE "%preqat%", "PREQAT", DOMAIN LIKE "%qat%", "QAT",DOMAIN LIKE "%preprod%","PREPROD") | search ENV =* |eval Referer="Single Line Purchase Device" |timechart span=1d count(eval(responseStatusCode="200")) as "Successful Transactions" by Referer] | appendcols[ search sourcetype=*index* Referer="*/prepaid/cart/orderreview" AND proxyURL="*/payment/v1/orders/payment-method" AND http_method="POST" result=* channel_id=* | join session_id[search (Referer="*/prepaid/myT-Mobile/change-plans-services/rate-plans" AND proxyURL="*/purchase-path-browse/v1/eligible-offers" http_method="POST") result=*| table session_id] | rex field=Referer "http?:\/\/(?[^/]+)" | eval ENV=case(DOMAIN LIKE "%preqat%", "PREQAT", DOMAIN LIKE "%qat%", "QAT",DOMAIN LIKE "%preprod%","PREPROD") | search ENV =* |eval Referer="Purhase session pass" |timechart span=1d count(eval(responseStatusCode="200")) as "Successful Transactions" by Referer] | appendcols[ search sourcetype=*index* Referer="*/prepaid/cart/orderreview" AND proxyURL="*/payment/v1/orders/payment-method" AND http_method="POST" result=* channel_id=* | join session_id[search ( Referer="*/prepaid/myT-Mobile/change-plans-services/services" AND proxyURL="*/purchase-path-browse/v1/conflicts" http_method="POST") result=*| table session_id] | rex field=Referer "http?:\/\/(?[^/]+)" | eval ENV=case(DOMAIN LIKE "%preqat%", "PREQAT", DOMAIN LIKE "%qat%", "QAT",DOMAIN LIKE "%preprod%","PREPROD") | search ENV =* |eval Referer="Change Rate Plan" |timechart span=1d count(eval(responseStatusCode="200")) as "Successful Transactions" by Referer] | appendcols[ search sourcetype=*index* Referer="*/prepaid/cart/orderpayment?cartId=*" AND proxyURL="*/payment/v1/orders/payment-method" AND http_method="POST" result=* channel_id=* | join session_id[search (Referer="*/prepaid/bring-your-own-device" AND proxyURL="*/utility/v1/general-info/valid-imei?imei=*" http_method="POST") result=*| table session_id] | rex field=Referer "http?:\/\/(?[^/]+)" | eval ENV=case(DOMAIN LIKE "%preqat%", "PREQAT", DOMAIN LIKE "%qat%", "QAT",DOMAIN LIKE "%preprod%","PREPROD") | search ENV =* |eval Referer="Single Line BYOD" |timechart span=1d count(eval(responseStatusCode="200")) as "Successful Transactions" by Referer] | appendcols[ search sourcetype=*index* Referer="*/prepaid/cart/orderconfirm" AND proxyURL="*purchase-path-order/v1/orders/*" AND http_method="POST" result=* channel_id=* | join session_id[search (Referer="*/prepaid/shop/device-details/*" AND proxyURL="*/purchase-path-browse/v1/product-details/*" http_method="POST") result=*| table session_id] | rex field=Referer "http?:\/\/(?[^/]+)" | eval ENV=case(DOMAIN LIKE "%preqat%", "PREQAT", DOMAIN LIKE "%qat%", "QAT",DOMAIN LIKE "%preprod%","PREPROD") | search ENV =* |eval Referer="Change/Upgrade Device" |timechart span=1d count(eval(responseStatusCode="200")) as "Successful Transactions" by Referer] ... View more