I am trying to create a query that returns a table showing counts of different error codes and percentage of transactions that are failing (error != 0) for each service.  service 0 3100 2000 1200 % Failure Foo 1000 12 0 0 1.2% Bar 100 0 3 2 5.0%   My query which returns the above table is:  index=my_index | where error=0 OR error!=0 | chart count by service, error | eval "% Failure"  = round(('3100'+'2000'+'1200')/('3100'+'2000'+'1200'+'0'),2)."%"   How can I modify this query so that I don't need to hardcode each error code into the last part of the query, as error codes may vary? ... View more

I'm new to regex and having trouble extracting some text. My raw data is in the following format: ID=[12839829389-8b7e89opf][2839128391DJ33838PR] I need to extract the text between the first two brackets,12839829389-8b7e89opf, into a new field.    So far what I have does not work: | rex field=_raw "ID=[(?<id>.*)]" If anyone could help it would be greatly appreciated. ... View more