</input><input type="dropdown" token="BankApp" searchWhenChanged="true" depends="$BankDropDown$"> <label>ApplicationName</label> <choice value="*">All</choice> <search> <query> | inputlookup BankIntegration.csv | dedup applicationName | sort applicationName | table applicationName </query> </search> <fieldForLabel>applicationName</fieldForLabel> <fieldForValue>applicationName</fieldForValue> <default>*</default> <prefix>applicationName="</prefix> <suffix>"</suffix> </input> <input type="dropdown" token="interface" searchWhenChanged="true" depends="$BankDropDown$"> <label>InterfaceName</label> <choice value="*">All</choice> <search> <query> | inputlookup BankIntegration.csv | search $BankApp$ | sort InterfaceName | table InterfaceName </query> </search> <fieldForLabel>InterfaceName</fieldForLabel> <fieldForValue>InterfaceName</fieldForValue> <default>*</default> <prefix>InterfaceName="</prefix> <suffix>"</suffix> </input> Query : index=mulesoft environment=PRD $BankApp$ OR (priority="ERROR" OR priority="WARN") | stats values(*) as * by correlationId | rename content.InterfaceName as InterfaceName content.FileList{} as FileList content.Filename as FileName content.ErrorMsg as ErrorMsg | eval Status=case(priority="ERROR","ERROR",priority="WARN","WARN",priority!="ERROR","SUCCESS") | fields Status InterfaceName applicationName FileList FileName correlationId ErrorMsg message | where $interface$ AND isnotnull(FileList) | sort -timestamp If i select all in dropdown the particular values of inputlookup  file fields and data should be showen.If its * then its shows all the values.This the query which i am trying to achieve things.  ... View more

Since you already have applicationName=" as your prefix, this line index=mulesoft environment=$env$ applicationName=$BankApp$ InterfaceName=$interface$ will expand to index=mulesoft environment=$env$ applicationName=applicationName="*" InterfaceName=InterfaceName="*" Either remove applicationName= from your prefix or from your search index=mulesoft environment=$env$ $BankApp$ $interface$ ... View more

@karthi2809  Try this example.  Changes : While setting the token on the change event, you should use the values .  PS : Added a token to the Interface text to demonstrate the changes.   <form version="1.1" theme="light"> <label>Depends_Rejects</label> <fieldset submitButton="false"></fieldset> <row> <panel id="panel_layout"> <input id="input_link_split_by" type="link" token="tokSplit" searchWhenChanged="true"> <label></label> <choice value="Finance">OVERVIEW</choice> <choice value="BankIntegrations">BANKS</choice> <default>OVERVIEW</default> <initialValue>OVERVIEW</initialValue> <change> <condition value="Finance"> <set token="Finance">$value$</set> <unset token="BankIntegrations"></unset> </condition> <condition value="BankIntegrations"> <set token="BankIntegrations">$value$</set> <unset token="Finance"></unset> </condition> </change> </input> </panel> </row> <row> <panel> <input type="time" token="time" searchWhenChanged="true"> <label>Time Interval</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="env" searchWhenChanged="true"> <label>Environment</label> <choice value="*">ALL</choice> <choice value="DEV">DEV</choice> <choice value="TEST">TEST</choice> <choice value="PRD">PRD</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="applicationName" searchWhenChanged="true" depends="$Finance$" rejects="$BankIntegrations$"> <label>ApplicationName</label> <choice value="*">ALL</choice> <choice value="p-wd-finance-api">p-wd-finance-api</choice> <default>"p-wd-finance-api</default> <initialValue>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</initialValue> <fieldForLabel>ApplicationName</fieldForLabel> <fieldForValue>ApplicationName</fieldForValue> </input> <input type="text" token="InterfaceName" searchWhenChanged="true" depends="$Finance$" rejects="$BankIntegrations$"> <label>InterfaceName</label> <default>$tokSplit$</default> <initialValue></initialValue> </input> <input type="dropdown" token="applicationName" searchWhenChanged="true" depends="$BankIntegrations$" rejects="$Finance$"> <label>ApplicationName</label> <choice value="p-wd-finance-api">p-wd-finance-api</choice> <default>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</default> <initialValue>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</initialValue> <fieldForLabel>ApplicationName</fieldForLabel> <fieldForValue>ApplicationName</fieldForValue> </input> <input type="text" token="InterfaceName" searchWhenChanged="true" depends="$BankIntegrations$" rejects="$Finance$"> <label>InterfaceName</label> <default>$tokSplit$</default> <initialValue></initialValue> </input> </panel> </row> </form>     Hope it helps! ... View more

@karthi2809  one advice here, don't post your org-specific queries as is. Obfuscate content to its maximum before posting in any public forum. ... View more

Thanks @scelikok  Its working  I am using  coalesce if the PRD success as success message if the error i want to show error msg instead of PRD Error message .So tried like below its not working  | eval output=mvfilter(match(message,"^PRD")) | eval Response= coalesce(error,errorMessage,output) ... View more

Try tostring duration |eventstats min(timestamp) AS Logon_Time, max(timestamp) AS Logoff_Time by correlationId | eval StartTime=round(strptime(Logon_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) | eval EndTime=round(strptime(Logoff_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) | eval ElapsedTimeInSecs=EndTime-StartTime | eval "Total Elapsed Time"=tostring(ElapsedTimeInSecs,"duration") ... View more

The fields are probably multivalue fields for some of your transactions which is why the eval is not working. You should probably start again with your events and work out how to break them up into separate parts so that you can create the composite id, in other words, to get where you want to be, don't start from where you are, you need to go back some steps. ... View more

@karthi2809 - Dashboard filters values shows in the URL, so once you get right URL, that should work.   I hope this helps!!!! ... View more

There doesn't appear to be anything wrong with case statement on its own. However, there are other statements which might affect your result, e.g. dedup. Please can you share some events demonstrating your issue? ... View more

And at same time it convert that field (result of case) to multivalue field which contains both those values. As @yuanliu said, you must provide sample data which produce that "error", if you want that we can help you. ... View more

You need to clarify the problem in search result as well as explain/illustrate your raw data.  "Can't populate result" can have a million different meanings.  Do you mean to say that you get a completely blank table, i.e., no results at all?  If this is the case, you probably do not have a field named correlationId in your raw data. Or do you mean values(content.File.fprocess_message) as ProcessMsg gives all null output? You cannot expect volunteers to read your mind.  Explain in no ambiguous terms. You speak about ProessMsg but it is not obvious whether a field named "ProcessMsg" exists in raw data, despite a suggestion of that coalesce function.  Again, you cannot just ask volunteers to speculate from your code (aka mind-reading) what raw data look like. Importantly, as @ITWhisperer  questioned, why go through all the trouble of coalescing if you are going to discard it, then use field name ProcessMsg to store output of a stats function, as indicated in values(content.File.fprocess_message) as ProcessMsg?  Most importantly, what is content.File.fprocess_message? Do you have evidence that this field even has value? Do you really mean   index="mulesoft" applicationName="ext" environment=DEV (*End of GL-import flow*) OR (message="GLImport Job Already Running, Please wait for the job to complete*") OR (message="process - No files found for import to ISG") |rename content.File.fstatus as Status |eval Status=case( like('Status' ,"%SUCCESS%"),"SUCCESS",like('Status',"%ERROR%"),"ERROR",like('message',"%process - No files found for import to ISG%"), "ERROR",like('message',"GLImport Job Already Running, Please wait for the job to complete"), "WARN") | eval ProcessMsg= coalesce(ProcessMsg,message) |stats values(content.File.fid) as "TransferBatch/OnDemand" values(content.File.fname) as "BatchName/FileName" values(ProcessMsg) as ProcessMsg values(Status) as Status values(content.File.isg_file_batch_id) as OracleBatchID values(content.File.total_rec_count) as "Total Record Count" by correlationId |table Status Start_Time "TransferBatch/OnDemand" "BatchName/FileName" ProcessMsg OracleBatchID "Total Record Count" ElapsedTimeInSecs "Total Elapsed Time" correlationId     ... View more

Try removing it from your initial filter index="mulesoft" applicationName="ext" environment=DEV (message="API: START: /v1/revpro-to-oracle/onDemand") OR (message="API: START: /v1/fin_Zuora_GL_Revpro_JournalImport") OR (message="API: START: /v1/revproGLImport/onDemand*") ... View more

If you get Limit of '100', you must be picking mind-reading #1 as you didn't pick #2.  That is just the problem with list.  You can increase this limit somewhat (see [stats|sistats]).  But be very careful. As to BATCH_ID, I still don't know what 134 and 26 mean.  One correlationId?  All events?  Is it because of the 100 limit on list_maxsize?  You should probably post a new question with proper set up and detailed explanation. ... View more

There is quite a lot going on here and I'm not fully sure you're getting proper results. Anyway. 1. The "base" search is not very well done. Firstly, you're searching for separate short tokens instead of whole strings in some of those parentheses. Secondly, you use wildcards at the beginning of your search terms. It kills performance. 2. The transaction command combines values of the same field across the whole transaction. That's how it works. 3. I'd try to combine the events by stats instead of transaction of course. Transaction is best avoided if you can. ... View more

Sure thing, you can use the mvfilter eval function to get rid of the unwanted value in the multivalue field   | eval yourfield = mvfilter(yourfield != "null") ... View more

If a case function returns no value it's because none of the expressions matched.  Adding a default expression | eval foo = case(..., 1==1, "???") will help flag edge cases that don't match the other expressions. In this instance, it seems the first expression needs some wildcards unless you're looking for an exact match. | eval Status=case(like('message',"%Exchange Rates Process Completed. File sucessfully sent to Concur%"),"SUCCESS", like('TracePoint',"%EXCEPTION%"),"ERROR")   ... View more

Working 👍 ... View more

The match function treats "%" as a literal character rather than as a wildcard.  Instead, match uses regular expressions.  Remove the "%" from the match string and you should get a status value. ... View more

Thanks  Working as expected 😊. ... View more

The first step is to make sure the data is valid JSON because the spath command will not work with invalid JSON.  jsonlint.com rejected the sample object. Here is a run-anywhere example that extracts payload as a single field. | makeresults format=json data="[{\"content\" : { \"jobName\" : \"PAY\", \"region\" : \"NZ\", \"payload\" : [ { \"Aresults\" : [ { \"count\" : \"6\", \"errorMessage\" : null, \"filename\" : \"9550044.csv\" } ] }, { \"Bresults\" : [ { \"count\" : \"6\", \"errorMessage\" : null, \"filename\" : \"9550044.csv\" } ] } ] }} ]" | spath output=payload content.payload{} ... View more