Thank you for the response yuanliu! Ultimately, what I am attempting to do is 'append' a statistics column when 1 UW is returned in a log. Example of my SPL query is below: index="internallogs"
sourcetype="internal"
host="*hostadress*"
source="FunctionApp"
(/api/assignmentsearch OR AssignmentSearchResults)
| eval _raw=replace(_raw,"(\\\\r\\\\n\s+)","")
| eval _raw=replace(_raw,"\\\\(\")","\"")
| rename additionalProperties.Key as TransactionID
| rename additionalProperties.JSON as JSON
| spath input=JSON path=AssignmentSearchResults{}.FullName output=RsUWName
| spath input=JSON path=Headers{}.profitCenterCode{} output=RqProfitCenter
| lookup uwmanagement-divisions.csv ProfitCenterCode as RqProfitCenter Outputnew ProfitCenterDescription as ProfitCenterOutput
| transaction TransactionID
| eval Results=case(
isnull(RsUWName), "Zero Returned",
mvcount(RsUWName) = 1, "Exactly One Returned",
mvcount(RsUWName) > 1, "More than One Returned"
)
| chart count by Results, ProfitCenterOutput
| addcoltotals labelfield=Results label="Total Calls" Currently, the output is as follows: Results Div1 Div 2 Div 3 1 UW 9 227 222 0 UWs 1 173 0 >1 UW 1 2 9 Total Calls 11 402 231 What my desired chart would look like: Results Div1 Div 2 Div 3 1 UW 9 227 222 0 UWs 1 173 0 >1 UW 1 2 9 Total Calls 11 402 231 % 1UW* 81% 56% 96% SLA** 90% 90% 90% * Where % 1UW is the number of times a log has exactly one returned UW (ie Results="Exactly One Returned"). So along the lines of "Exactly One Returned" / ("Exactly One Returned" + "Zero Retuned" + "More than One Returned") * 100. ** Service Level Agreement (SLA) is a hard coded value that is specific to a PorfitCenterOutput (ie Div1 90%, Div2 75%, Div3 60%). I know that using the append command can add an additional row to a chart, but I am having difficulty getting the stats for "% 1UW" from "Results".
... View more
