stdev is supported as an aggregation function to stats commands not a function to eval command ... View more

Hi @amitrinx, you have to insert an activation threshold, something like this: sourcetype="os" identity_operation="GetUser" minutesago= 1 | rename "Get User" AS EndpointName | stats count by EndpointName | where count>= 0.7 * 1200 | eval message = case(count>=1*1200,"100% alert", count>=0.9*1200,"90% alert", count>=0.8*1200,"80% warning", count>=0.7*1200,"70% warning") otherwise, your alert is always triggered also for values less than your threshold. Ciao. Giuseppe ... View more

Check the spelling of the field names.  The one used in the lookup command must be the same one produced by stats.  I did get the order of arguments wrong, however.  Check my modified answer. ... View more

Please check that you have copied it correctly because this has been copied directly from a valid search ... View more

Hi @amitrinx, could you share some complete log sample, without it it's difficoult to help you. Anyway, the regex from @yuanliu seems to be correct and you could try to use it. Ciao. Giuseppe ... View more

OK. Try to describe what you want to achieve (in terms of what events you have and what result you want to get from them), not what you're trying to do. ... View more

Please can you share some events from both sourcetypes (anonymised of course), preferably in code blocks </> to prevent information being removes by the formatting process. ... View more

Firstly, the topic says "multisearch" and you're using map. Secondly, you don't have any event-generating commands in your map. Thirdly, most probably this isnot the way to solve your problem. ... View more

It looks like you're trying to use a subsearch without putting the subsearch inside brackets. sourcetype="blabla" http_url = "some endpoint" minutesago=[|inputlookup SomeFile.csv | search Endpoint = "Some endpoint" | return $Window] Using $Window tells the return command to return only the field value rather than a key/value pair. ... View more

Hi @amitrinx, when you say "textbox" are you meaning a Single Value Panel or what else? If a Single Value panel, you have to use a search like the following in the Single Value Panel: | makeresults | eval text=$token$ | table text where $token$ is the token of the dropdown. Ciao. Giuseppe ... View more