Thank you ! it worked. ... View more

Hello It worked, but showing incorrect time of "ACK" alerts and it's skipping "Resolved" time in second row of single "incidentNumber".   ... View more

here is result, it worked, but how can we use on my source type/index?  Please help, i m just a beginner. My data is below,   ... View more

hello   Any update on this? ... View more

hello I want to time  format of column "TIME", i have formatted it, but resulting "NULL" output as these times are showing from single field called "transition{].at" and unable to do format of two values at a time into table.   startTime: 2021-08-26T11:02:25Z    transitions: [ [-]      { [-]        at: 2021-08-26T11:03:06Z        by: asma.sahbani        name: ACKED      }      { [-]        at: 2021-08-26T11:12:58Z        by: asma.sahbani        manually: true        name: RESOLVED      } ... View more

i did mvexpand for this, i need time format for "TIME" col. PFB     ... View more

Hi @ITWhisperer  I have multiple alerts of incidentNumber, user , ack time and resolved time.  how can i sort my whole data as having lots of rows?   ... View more

Hi @ITWhisperer  This helps and result is good. Thank you ! ... View more

Hi,   No i haven't use mvmap for this. These are multi- value fields from same field called transitions{}.at 858681 mike.dowling mike.dowling 2021-08-25T14:44:00Z 2021-08-25T14:53:40Z ACKED RESOLVED ... View more

Hello @ITWhisperer , I searched with your query and still getting "00:00:00" result to all rows.   PFA. please help !   ... View more

Hello Thank you !  I used this and this shows "00:00:00" result to all time spam. PFA Please advise further!   ... View more

@gcusello - any update? ... View more

Thanks ! But i want both result in one table. i have my query with me. please review below. index= source1234  routingKey=routingTOC_PTS OR routingKey=routingPTS_SCTEAM OR routingKey=routingKeyPTS_ASP OR routingKey=routingKeyPTS_TOC_INFO OR routingKey=routingKeyPTS_NOC OR routingKey= routingKeyGMI_IT  OR routingKey=routingdefault OR routingKey=routingPTS_DBA_RIMS OR routingKey=routingptssdba OR routingKey=routingRIMS_APP_TEST| top limit=50 routingKey | stats sum(count) as count, avg(percent) as percent | eval routingKey = "PTS" | dedup incidentNumber | append [ search routingKey=routingDA OR routingOra_DBA_IO OR routingKey=routingEngine OR routingKey=routingSE OR routingKey=routingTOC OR routingwaiting_room | top limit=50 routingKey | stats sum(count) as count, avg(percent) as percent |eval routingKey = "IA" ] |  addcoltotals labelfield=routingKey label=Total | table routingKey, count, percent   Output of my query -- Product            Count       Percent PTS                   count(all routing of PTS) IA                        count(all routing of IA   So now, which i have highlighted that count i need in separate column and others in separate one  in one result, Output should be like --   Product             Count of TOC                               Count of others PTS                    Count(routingTOC_PTS)             Count (others routingKey) IA                         Count(routingKey=routingTOC)    Count(others routingKey)   Hope this understands my question. ... View more

Hello   Given query resulted below.     ... View more

@richgalloway - Below you which you given solution, parsing my output. Please advise.       ... View more

Hi Rich   Solution you given worked perfectly, but its parsing my output and getting time for result. Also, I need average of all results , but it do sum of all avg in Totals. Plz advise.         ... View more

Its parsing my output as I have number of routingKey to append. ... View more

index=victorops  routingKey=routingA OR routingKey=routingB OR routingKey=routingKeyC OR routingKey=routingKeyD OR routingKey=routingE | top limit=50 routingKey | stats sum(count) as count, avg(percent) as percent | eval routingKey = "IA" | append [ search routingKey=routingAA OR routingAB OR routingKey=routingAC OR routingKey=routingAD OR routingKey=routingAE | top limit=50 routingKey | stats sum(count) as count, avg(percent) as percent |eval routingKey = "IB" ] |  addcoltotals labelfield=routingKey label=Total | table routingKey, count, percent     Above resulted below -- Product Name     Count    Percent IA                                  50             0.25 IB                                   40             30 Total                             90   (Sum of routigKey)          15.125 (avg) ----I need this as average   But while running above query, its parsing my output. Plz advise ... View more

Hello These query gives the output all my routingKey in ascending order. I need below --   Product Name  Count  Percent (avg) IA                            50          50% IB                             75          30% IC                             55           0.5% ID                               0            0% Each product name has different routingKey. Output should be -- i need avg for percent in TOTAL row.       ... View more

Hello, Thanks for help ! But , i have multiple routingKey's for one Output. So how can I modify this? Below is example which I have run for my report.I need addtotals for all with count and percent(avg) --Below results parsing my output. I have "IA- IJ" field values. index=victorops  routingKey=routingA OR routingKey=routingB OR routingKey=routingKeyC OR routingKey=routingKeyD OR routingKey=routingE | top limit=50 routingKey | stats sum(count) as count, avg(percent) as percent | eval routingKey = "IA" | append [ search routingKey=routingAA OR routingAB OR routingKey=routingAC OR routingKey=routingAD OR routingKey=routingAE | top limit=50 routingKey | stats sum(count) as count, avg(percent) as percent |eval routingKey = "IB" ] |  addcoltotals labelfield=routingKey label=Total | table routingKey, count, percent   ... View more

Thanks ! Its worked.  I m using append query multiple times for different searches for same index. Its parsing my job. Please advise solution.     ... View more