About michalmartofel

michalmartofel · ‎07-21-2021

1. Yes, excatly, i need the sum of the values in the errors column. 2. About timechart.. Actually i have a timechart with one product with query: index = nsw_prod_eximee ERROR | regex _raw="[F][G][S]\d{9}" | dedup formInstanceNumber | timechart count by dc(formInstanceNumber OR applicationNumber) where count in top99 But now i want to have all products which have different regex (FGS, FGH, FGT, USP) and different field to dedup (with FGS and FGH i need to dedup variable formInstanceNumber, for USP and FGT it's applicationNumber). For one product it's okey, but how to connect all that regexes with dedups in timechart. That's my question.

michalmartofel · ‎07-21-2021

Hi, i have a problem with a few queries. I have something actually like this: index = nsw_prod_eximee ERROR | rex field=formInstanceNumber (?<pref>\w{3})\d{9} | rex field=applicationNumber (?<pref>\w{3})\d{9} | eval "Name" = case(pref=="USP", "mProtection", pref=="FGT", "mTravel", pref=="FGH", "HouseHold", pref=="FGS", "mMoto") | stats count as formInstanceNumber by "Name" | rename formInstanceNumber as "Errors" And i have a table with a 4 values: But now i have a problem to count a column "Errors". I want to count all Errors. 2. The second problem i have, i can't do the timechart and i need help with it. I want to do timechart with that all values, but when i do that, there is no columns on timechart. How to get that query? Thanks in advance.

Posts	2
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-21-2021

Online Status	Offline
Date Last Visited	‎07-21-2021 07:28 AM

Count with few eval and timechart

Re: Count with few eval and timechart

Count with few eval and timechart

Are you a member of the Splunk Community?

Count with few eval and timechart

Re: Count with few eval and timechart

Count with few eval and timechart