I have written a search that breaks down the four values in the majorCustomer field and counts the number of servers in each of the four majorCustomers. What I want to do is combine the commercial and information systems customer into one called corporate and have the count be a sum of their individual server counts. Any suggestions? This is the search: index=citrix | fields majorCustomer Host | rename majorCustomer as "Line of Business" | stats count(Host) as Servers by "Line of Business" | eventstats sum(Servers) as Total | eval Percentage = (Servers/Total)*100 | eval Percentage = round(Percentage, 2) | eval Percentage = Percentage + "%" | table "Line of Business" Servers Percentage | sort -Servers! alt text ... View more

I have a search that returns two different values for avg_duration. These values are an average of all the the values that fall under that state of either NEW or OLD. What I need to do now is access the avg_duration's separately in order to determing whether the avg_duration for the NEW or OLD is bigger. The search is: | sort targetId timestamp | stats first(timestamp) as start, last(timestamp) as end, first(task) as task0, last(task) as task1, first(status) as status0, last(status) as status1 by targetId | eval curr_time=now() | eval start_time=if(status0="Started" AND task0="Build CI" AND status1="Completed", strptime(start, "%m/%d/%Y %l:%M:%S %p"), 0) | eval start_time=ifnull(start_time, strptime(start, "%Y-%m-%dT%H:%M:%SZ")) | eval start_time=ifnull(start_time, strptime(start, "%Y-%m-%dT%H:%M:%S.%QZ")) | eval end_time = if(status0="Started" AND task0="Build CI" AND status1="Completed", strptime(end, "%m/%d/%Y %l:%M:%S %p"), 0) | eval end_time=ifnull(end_time, strptime(end, "%Y-%m-%dT%H:%M:%SZ")) | eval end_time=ifnull(end_time, strptime(end, "%Y-%m-%dT%H:%M:%S.%QZ")) | eval start_time=round(start_time, 2) | eval end_time=round(end_time, 2) | eval duration=if(status0="Started" AND task0="Build CI" AND status1="Completed", end_time-start_time, "No Duration") | where duration!="No Duration" | eval state=if(start_time+1296000>=curr_time, "NEW", "OLD") | stats avg(duration) as avg_duration by state The search and output are shown in the attached picture. ... View more