It doesn't sound like it is expected. Can you give examples of your data and your searches? ... View more

I am guessing that you don't have any events for that service, but I am also guessing that there is more than one service and you want an alert if any one of them has a count of zero? If so, why not flip it to do your counts by service and then alert if you don't have a full set of counts e.g. if there are 10 services, if you don't get 10 rows back from the stats count by service, you know at least one of the services is missing? ... View more

What is $Org$ doing at the end of the panel queries? <query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ $Org$ has already been used to select which panels to show. It probably doesn't have a valid value for the queries. You already have OrgFolderName=merchant in the merchant panel  ... View more

mvfi('form.Org',"All") needs to be mvfind('form.Org',"All") ... View more

Al the evals need to be in a change clause ... <default>All</default> <change> <eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval> ...   ... View more

Join the two rows together | stats values(*) as * Calculate percentage | eval p=tonumber(mvindex(count,0))/tonumber(mvindex(count,1)) | fields p  You might need a sort (by releasepast) before the stats to ensure the counts are in the right order ... View more

@tb5821 Do you have some sample events you can share to show what you are dealing with? ... View more

Calculate days past | eval dayspast=floor((now()-_time)/(60*60*24)) Calculate days since Wednesday | eval dsw=(tonumber(strftime(_time,"%w")) + 4) % 7  Calculate how far back the release cycle is | eval releasepast=floor((dayspast - dsw) / 7) Reduce events to previous and current release | where releasepast < 2 Count errors | stats count by releasepast You now have the values you need to work out your percentage ... View more

Rather than using "*" for "All Org" try using "All" as in my suggestion, then when you try to find it you are not looking for a wildcard. Also, gcpi is missing a leading double quote in the mvfind ... View more

... | rex field=ARGS "(?<ARGS>.*)_-D" ... View more

@aditsss OK Thanks for clarifying the requirement. Try something like this (now with All option):   ... <row> <panel> <input type="multiselect" token="panels"> <label>Select one or more panels</label> <choice value="All">All</choice> <choice value="merchant">merchant</choice> <choice value="force">force</choice> <choice value="one">one</choice> <choice value="force2">force2</choice> ... <default>All</default> <change> <eval token="form.panels">case(mvcount('form.panels')=0,"All",mvcount('form.panels')&gt;1 AND mvfind('form.panels',"All")&gt;0,"All",mvcount('form.panels')&gt;1 AND mvfind('form.panels',"All")=0,mvfilter('form.panels'!="All"),1==1,'form.panels')</eval> <eval token="merchant">if(isnull(mvfind('form.panels',"merchant")),mvfind('form.panels',"All"),1)</eval> <eval token="force">if(isnull(mvfind('form.panels',"force")),mvfind('form.panels',"All"),1)</eval> <eval token="one">if(isnull(mvfind('form.panels',"one")),mvfind('form.panels',"All"),1)</eval> <eval token="force2">if(isnull(mvfind('form.panels',"force2")),mvfind('form.panels',"All"),1)</eval> ... </change> </input> </panel> </row> ... <panel depends="$merchant$"> ... <panel depends="$force$"> ...   Things to note: the evals have to be on single lines (no line breaks); the first eval  removes "All" if anything else is selected, and adds it if nothing is selected; it doesn't matter what the token is set to so I am setting them to 1 (or null if not selected); setting a token to null is the same as unsetting it. ... View more

You could add a running total column and trigger on that exceeding 100 ... | streamstats sum(sum) as total   ... View more

You just need to make your query retrieve all the events without the stats clauses and change your alert so it triggers on the number of results (rather than custom) ... View more

This seems to imply that field1 and field2 are either duplicated in the original event, or that the extraction process in duplicating them. You probably need to look at the props and transform configurations ... View more

You can extract fields from the xml using various techniques and display them in a table or chart depending on your requirements. What information are you interested in from your XML events? ... View more

What happens if you just try min and avg or max and avg (i.e. not all 3)? ... View more

If you are hiding all but the selected item from the drop down, this doesn't sound like a multi-select Your rows need a depends attribute, e.g. <row depends=$show_merchant$> The change from the dropdown can unset all the tokens apart from the token for the selected row  ... View more

Does putting commas between or using different names help? <base_search> | stats min(response_time) as minimum, max(response_time) as maximum, avg(response_time) as average by repository ... View more