I have the following search index=xoom_app_online_checkout_orchestration_api (level=ERROR AND "Failed to get open-banking realtime balance" AND issue=* ) OR event_type=OPEN_BANKING_REALTIME_BALANCE_SUCCESS | eval Issue=if(event_type=="OPEN_BANKING_REALTIME_BALANCE_SUCCESS", "OPEN_BANKING_REALTIME_BALANCE_SUCCESS", issue) |  stats count as Count by Issue | eventstats sum(Count) as Total | eval Percentage=round((Count/Total)*100,2) | fields - Total | sort 0 - Count | addcoltotals   I get this result:   Issue                                                                                                Count Percentage OPEN_BANKING_REALTIME_BALANCE_SUCCESS 181 76.05 VALIDATION_ERROR 42 17.65 INVALID_LOGIN_CREDENTIALS 14 5.88 PERMISSION_DENIED 1 0.42   238 100.00   I want to trigger an alert if the "Percentage" value of the row  with Issue= OPEN_BANKING_REALTIME_BALANCE_SUCCESS is < 75 Could not figure out how to add a hidden filed or so... to use as the WHERE clause for the alert ... View more

I have two different searches: 1. index=xoom_app_online_checkout_orchestration_api user_id residence_country=US request_cobrand=null  2.  index!=xoom_app_online_checkout_orchestration_api user_id tracing_user_id tracing_user_type="ABC"    From the first search, I want to retrieve user_id From the second search, I want to retrieve tracing_user_id I only want a response if user_id=tracing_user_id I was using this query, but it was ignoring values from search (1):   ( index="xoom_app_online_checkout_orchestration_api" user_id residence_country=US request_cobrand=null ) OR (index!=xoom_app_online_checkout_orchestration_api tracing_user_id tracing_user_type="ABC" ) | eval joiner=if(index="xoom_app_online_checkout_orchestration_api", user_id, tracing_user_id)| stats values(*) as * by joiner | WHERE user_id=tracing_user_id   ... View more

I have the following splunk event: 2020-Jul-30 18:19:02.891Z level=DEBUG thread=https-jsse-nio-2720-exec-9 pid=20 code_location=c.x.p.service.WebhookEventServiceImpl request_id=1fPwftTa2ylVm7CbcwnBirNhhjX trace_id=79d2157d38d3fd37 Processing message event[id=WH-29K757251Y0625428-0EP848134S044830M; resourceType=dispute; paypalDebugId=bac532dd23d05] using routingKey[com.xoom.paypal-events.v1.CUSTOMER.DISPUTE.UPDATED]. 1. I want to create a chart that aggregates by resourceType and routingKey. 2. I have the following command index="myindex" sourcetype="mySourceType" "Processing message event" | rex field=instance "routingKey\[(?<eventType>)\]\s" | chart count by resourceType eventType 3. The result I get is just by resourceType. I am not  able to assign the <eventType> variable to a field name for the chart. splunk chart     ... View more