Is is possible to create a dashboard such that user provide customerID and all details like order placed or email sent to customer gets displayed as dashboard. If yes please share the link of tutorial or article where I can get this ... View more

I have two fields in two different log lines and want result something like below sample table :- product_code_pause count product_code_unpause count 1234567 3 1234567 2   How can I achieve this by updating below query :- ("Pause entry") OR ("Paused Entry added back to cart successfully : ") | rex field=_raw "product : (?<product_code_pause>(?:[^,]+))" | rex field=_raw "successfully : (?<product_code_unpause>(?:[^,]+))" | stats count by product_code_pause,product_code_unpause ... View more

I want to get the result and divide it into three sections as three-column such as last 15 min result, avg of 7 day and avg of one day. I have used below search but somehow I am getting values in only two columns i.e. product and sevenDayAvg. Two other column 'oneDayAvg' and 'quantity1' is coming as blank. Below is my search: index="in" daysago=7 "Product" AND "TotalQTY" | rex field=_raw "Product:(?<Product>[0-9]{5,15}),TotalQTY:(?<quantity>[0-9]{1,5})" | eventstats sum(quantity) as totalsale BY Product |eval sevenDayAvg=totalsale/672 | append [search index=hybris_prod host=dep-prd-db-monitoring daysago=1 "Product" AND "TotalQTY" | rex field=_raw "Product:(?<Product>[0-9]{5,15}),TotalQTY:(?<quantity>[0-9]{1,5})" | eventstats sum(quantity) as totalsale BY Product |eval oneDayAvg=totalsale/96] | append [search index=hybris_prod host=dep-prd-db-monitoring earliest=-15m@m now() "Product" AND "TotalQTY" | rex field=_raw "Product:(?<Product>[0-9]{5,15}),TotalQTY:(?<quantity1>[0-9]{1,5})" ] | dedup Product | table Product,quantity1,oneDayAvg,sevenDayAvg Please note all three searches are working fine if I use them individually. ... View more