Need to pass the result of query1 to as a input string for the second query. For the First query i'm getting output(x-corelation id) as a filed, that output field(x-corelation id) as a input for the second query to get errors. Attached both queries below, Please find the attachments and help me out with the requirement.  query 1:-  index=cloud_ecp sourcetype="prod-ecp-aks-cluster-logs" "bookAppointmentRequest" | fields data.req.headers.xcorrelationid   query 2 :-  index=cloud_ecp sourcetype="prod-ecp-aks-cluster-logs" <co-relationid of query1> "Error"   Note :- the co-relationid's are more than one, need to loop all those id's if any. ... View more

I'm trying to pass the result of one query to as input field for another query. Please see the below screen shots and help me out. query1: index=* sourcetype="prod-ecp-aks-" "bookAppointmentRequest" "Fname" "Lname" | fields data.req.headers.xcorrelationid. It will return the co-relation id.   query 2:  index=*  sourcetype="prod-ecp-aks" "7403cb0a-885d-36ee-0857-fa7e99741bf7" "da_appointment" It will return the appointments for that co-relation id.   I want to combine these two queries and pass that co-relation id. Note:-  The co-relation id's are more than one sometime, I need appointment id's for all the co-relation id's.   I gone through so many links, tried join, subquery but didn't get expected result. Please help me out. Thanks. ... View more

Hi, I need list of all the successful events details in the 'If' condition. For those successful list I need to extract few more details and send alert.  I tried stats count it is giving only count and for the eventstats it is giving all the values(Success and Failed events). Please help me here to get the detail list of successful events. Please see the below attachment. ... View more