Hi @gcusello  With the provided query i am able to get a column chart  which shows total no of request,200 statuscode,400 statuscode,500 statuscode.But how can i show 200 as green ,400 as orange,500 as red... Tried below option inside the source but unable to get the colors in column chart... <option name="charting.chart">column</option>         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>         <option name="charting.drilldown">all</option>         <option name="charting.fieldColors">{"200":0xFF0000,201:0x33ff00,204:0x66ff00,303:0xffaa00,304:0xffff00,404:0xff0000}</option>         <option name="charting.legend.placement">right</option> ... View more

index="1**" source="2***" | rex "(?ms)statusCode: (?<status_code>\d+)" | stats count by statusCode | appendcols [ search index="1**" source="2**" "republish event" | stats dc(event.body) AS totalrequest ] Hi @gcusello With the above query i get only statuscode count either 200 or 400....but the append search totalrequest  is not mapped to a color ... View more

Hi @gcusello  I am able to get different  status code in a pie chart ,if i also want to append an another query count to get the "totalrequest" ....its not adding to pie chart How can i add below in pie chart...lets say the total request count say 3 success 200-2(green color) 400 error-1(pink color) 500 error-1(red color) index="1**" source="2***" | rex "(?ms)statusCode: (?<status_code>\d+)" | stats count by statusCode | appendcols [search index="1**" source="2**" "republish event"| stats count by event.body | stats count | rename count as totalrequest] ... View more

Thanks @gcusello  Below query matches the correct count of all the statuscode " rex "(?ms)statusCode: (?<status_code>\d+)" | stats count by statusCode | table statusCode,count" ... View more

Hi @gcusello  I tried below query but its not fetching the correct counts of each statuscode...If i want to capture other statuscode greater than 400 ,>500 how should i include it  index="**" source="****" | rex "\"statusCode\":(?<statusCode>[\d]*)" | stats count by statusCode | eval statusCode =case(statusCode="200","success",statusCode="500","Internal Server Error",statusCode="400","Bad Request") | table statusCode,count ... View more

Hi @gcusello  1.With below query  i am trying to fetch three fields from three different event logs which match all 3 condition CASE is used get the extact uppercase/lowercase match of "latest,material" from first log event "id,material" from second log event "dynamoDB data retrieved for ids,dataNotFoundIdsCount,material" from third log event  from third event log   CASE("latest") AND "id" AND "dynamoDB data retrieved for ids" AND "material"   Based on above condition                             PST_TIME4  objectType version republishType  publish nspConsumerList snsPublishedCount dataNotFoundIdsCount 2023-20-11 02:55:12 material latest id NSP ALL 3 1 2023-16-11 09:18:14 material latest id NSP ALL 3 1 2023-12-12 05:03:37 material latest id ALL ALL 1 2 2.CASE("latest") AND "id" AND "sns published count" AND "material" Appendcols is used to fetch sns published count,publish,version,republishInput along with other filter condition latest,id,material     ... View more

PST_TIME4 objectType version republishType publish nspConsumerList snsPublishedCount dataNotFoundIdsCount 2023-17-11 01:50:35 material latest id NSP ALL 3 1 2023-20-11 02:55:12 material latest id NSP ALL 3 1 2023-16-11 09:18:14 material latest id NSP ALL 3 1 2023-12-12 05:03:37 material latest id ALL ALL 1 2 ... View more

Thanks @gcusello  The inclusive condition also worked... ... View more

Hi @ITWhisperer  Added a log to all the event to that it can be picked up commonly,which resolved it   ... View more

    Hi @ITWhisperer  Based on the below  the raw events....I need to filter based on the attribute "suppliedMaterial"  and "version"- get the result of row and then add the columns of sqsSentCount and dataNotFoundIdsCount similar to below objectType version dataNotFoundIdsCount sqsSentCount suppliedMaterial all 1 8 suppliedMaterial latest 3 9 Material all 3 11 Material latest 6 10               supplied material 1st event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"event":{"resource":"/v1/reprocess/id","path":"/support/v1/reprocess/id","httpMethod":"POST","pathParameters":null,"queryStringParameters":null,"body":"{\n \"objectType\": \"suppliedMaterial\",\n \"objectIds\": [\n \"569683\",\n \"564373er\",\n \"569129\"\n ],\n \"version\": \"all\"\n}","requestContext":{"requestId":"","authorizer":{"principalId":"","integrationLatency":0},"domainName":""}},"msg":"reprocess event","time":"2023-11-15T05:47:59.318Z","v":0} 2nd event- 
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","dataNotFoundIds":["564373er"],"dataNotFoundIdsCount":1,"msg":"data not found for Ids","time":"2023-11-15T05:47:59.329Z","v":0} 3rd event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","sqsSentCount":8,"msg":"sqs sent count","time":"2023-11-15T05:47:59.364Z","v":0} 4th event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"eventBody":{"objectType":"suppliedMaterial","objectIds":["569683","564373er","669179"],"version":"all"},"msg":"request body","time":"2023-11-15T05:47:59.318Z","v":0} 5 event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"event":{"resource":"/v1/reprocess/id","path":"/support/v1/reprocess/id","httpMethod":"POST","pathParameters":null,"queryStringParameters":null,"body":"{\n \"objectType\": \"suppliedMaterial\",\n \"objectIds\": [\n \"569683\",\n \"564373er\",\n \"669179\"\n ],\n \"version\": \"latest\"\n}","requestContext":{"requestId":"","authorizer":{"principalId":"","integrationLatency":0},"domainName":""}},"msg":"reprocess event","time":"2023-11-15T05:47:59.318Z","v":0} 6 event- 
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","dataNotFoundIds":["564373er"],"dataNotFoundIdsCount":3,"msg":"data not found for Ids","time":"2023-11-15T05:47:59.329Z","v":0} 7 event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","sqsSentCount":9,"msg":"sqs sent count","time":"2023-11-15T05:47:59.364Z","v":0} 8 event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"eventBody":{"objectType":"suppliedMaterial","objectIds":["569683","564373er","569129"],"version":"latest"},"msg":"request body","time":"2023-11-15T05:47:59.318Z","v":0} material 1st event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"event":{"resource":"/v1/reprocess/id","path":"/support/v1/reprocess/id","httpMethod":"POST","pathParameters":null,"queryStringParameters":null,"body":"{\n \"objectType\": \"material\",\n \"objectIds\": [\n \"569683\",\n \"564373er\",\n \"469196\"\n ],\n \"version\": \"all\"\n}","requestContext":{"requestId":"","authorizer":{"principalId":"","integrationLatency":0},"domainName":""}},"msg":"reprocess event","time":"2023-11-15T05:47:59.318Z","v":0} 2nd event- 
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"material","dataNotFoundIds":["564373er"],"dataNotFoundIdsCount":3,"msg":"data not found for Ids","time":"2023-11-15T05:47:59.329Z","v":0} 3rd event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"material","sqsSentCount":11,"msg":"sqs sent count","time":"2023-11-15T05:47:59.364Z","v":0} 4th event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"eventBody":{"objectType":"material","objectIds":["569683","564373er","569129"],"version":"all"},"msg":"request body","time":"2023-11-15T05:47:59.318Z","v":0} 5 event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"event":{"resource":"/v1/reprocess/id","path":"/support/v1/reprocess/id","httpMethod":"POST","pathParameters":null,"queryStringParameters":null,"body":"{\n \"objectType\": \"suppliedMaterial\",\n \"objectIds\": [\n \"569683\",\n \"564373er\",\n \"569129\"\n ],\n \"version\": \"latest\"\n}","requestContext":{"requestId":"","authorizer":{"principalId":"","integrationLatency":0},"domainName":""}},"msg":"reprocess event","time":"2023-11-15T05:47:59.318Z","v":0} 6 event- 
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","dataNotFoundIds":["564373er"],"dataNotFoundIdsCount":6,"msg":"data not found for Ids","time":"2023-11-15T05:47:59.329Z","v":0} 7 event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","sqsSentCount":10,"msg":"sqs sent count","time":"2023-11-15T05:47:59.364Z","v":0} 8event- {"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"eventBody":{"objectType":"suppliedMaterial","objectIds":["569683","564373er","569129"],"version":"latest"},"msg":"request body","time":"2023-11-15T05:47:59.318Z","v":0}       ... View more

Thanks much @ITWhisperer It really worked ... View more

thank you @ITWhisperer  Above solution worked ... View more

HI @ITWhisperer    I want all three query combined and display their results in one table based on entity:suppliedMaterial   uniqObjectIds   uniqObjectIdsCount PST_TIME uniqueRetrievedIds{} uniqueRetrievedIds PST_TIME dataNotFoundIds dataNotFoundIdsCount PST_TIME       122598 268817 88888888888 99999999999999999 abc 5 122598 268817 88888888888 99999999999999999 abc 5 122598 268817 88888888888 99999999999999999 abc 2023-08-11 06:38:01 122598 268817 122598 268817 2023-08-11 06:38:01       88888888888 99999999999999999 abc 3 122598 268817 88888888888 99999999999999999 abc 5 122598 268817 88888888888 99999999999999999 abc 2023-08-11 06:38:01 122598 268817 122598 268817 2023-08-11 06:37:44       similar to above similar to above similar to above similar to above  ssimilar to above  similar to above similar to above similar to above similar to above     similar to above     ....                       ... View more

continue... Hi @ITWhisperer The query used to get the above three table format       1st query: index= source IN ("") "uniqObjectIds" OR "data retrieved for Ids" | eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=uniqObjectIds path=uniqObjectIds{} |where isnotnull(uniqObjectIds) | spath output=uniqueRetrievedIds path=uniqueRetrievedIds{}| stats values(*) as * by _raw | table uniqObjectIds,uniqObjectIdsCount,uniqObjectIds{},PST_TIME | sort- PST_TIME 2nd query" index= source IN ("") "data retrieved for Ids"| eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=uniqueRetrievedIds path=uniqueRetrievedIds{} |where isnotnull(uniqueRetrievedIds)| stats values(*) as * by _raw | table uniqueRetrievedIds{},uniqueRetrievedIds, PST_TIME | sort- PST_TIME 3rd query: index= source IN ("") "data not found for Ids"| eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=dataNotFoundIds path=dataNotFoundIds{}|where isnotnull(dataNotFoundIds) | stats values(*) as * by _raw | table dataNotFoundIds{},dataNotFoundIdsCount, PST_TIME | sort- PST_TIME       Could you help ... View more

Hi @ITWhisperer  Thank for your reply and suggestions.Really appreciate ! Now I have added a log in all the below  raw event which will have "entity":"suppliedMaterial"     {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","uniqObjectIds":["122598","268817","88888888888","99999999999999999","abc"],"uniqObjectIdsCount":5,"msg":"unique objectIds","time":"2023-11-09T13:56:36.559Z","v":0} 2nd event {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","uniqueRetrievedIds":[],"msg":"data retrieved for Ids","time":"2023-11-09T13:56:36.749Z","v":0} 3rd event {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","dataNotFoundIds":["122598","268817","88888888888","99999999999999999","abc"],"dataNotFoundIdsCount":5,"msg":"data not found for Ids","time":"2023-11-09T13:56:36.749Z","v":0}     Currently i have three query which fetch the result from _raw in below table format  Expected.I want all three different table combined and show their result   based on common key value entity: "suppliedMaterial" from raw events .   uniqObjectIds uniqObjectIdsCount uniqObjectIds{} PST_TIME 122598 268817 88888888888 99999999999999999 abc 5 122598 268817 88888888888 99999999999999999 abc 2023-08-11 06:38:01 122598 268817 88888888888 99999999999999999 abcdefg 5 122598 268817 88888888888 99999999999999999 abcdefg 2023-08-11 06:37:44 122598 268817 88888888888 99999999999999999 abcdefg 5 122598 268817 88888888888 99999999999999999 abcdefg 2023-08-11 06:35:40 122598 268817 88888888888 99999999999999999 abcdefg 5 122598 268817 88888888888 99999999999999999 abcdefg 2023-08-11 06:33:14 uniqueRetrievedIds{} uniqueRetrievedIds PST_TIME 122598 268817 122598 268817 2023-08-11 06:38:01 122598 268817 122598 268817 2023-08-11 06:37:44 122598 268817 122598 268817 2023-08-11 06:35:40 122598 268817 122598 268817 2023-08-11 06:33:14 122598 268817 122598 268817 2023-08-11 03:28:56 275649 275649 2023-06-11 06:49:10 275649 275649 2023-03-11 04:28:36 275649 275649 2023-03-11 03:13:07 108795 108795 2023-03-11 03:09:07 108795 275649 108795 275649 2023-02-11 14:44:04 dataNotFoundIds{} dataNotFoundIdsCount PST_TIME 88888888888 99999999999999999 abc 3 2023-08-11 06:38:01 88888888888 99999999999999999 abcdefg 3 2023-08-11 06:37:44 88888888888 99999999999999999 abcdefg 3 2023-08-11 06:35:40 88888888888 99999999999999999 abcdefg 3     ... View more

Hi @ITWhisperer  Below are the raw events  which are need to be displayed in table format in a single row for below events with no common key value {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"uniqObjectIds":["275649"],"uniqObjectIdsCount":1,"msg":"unique objectIds","time":"2023-11-03T19:26:43.672Z","v":0} {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"uniqueRetrievedIds":["275649"],"msg":"data retrieved for Ids","time":"2023-11-06T22:48:03.594Z","v":0} {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"eventBody":{"objectType":"material","objectIds":["275649","108795","1234567","1234568","99999999","888888888"],"version":"all"},"msg":"request body","time":"2023-11-03T05:25:33.508Z","v":0} ... View more

Thanks @ITWhisperer the above spath query which worked and was able to form a table view without duplicate. How can i combine two events results in a single row rather than display in two rows ,there is no common key to do stats by it has same source and index only the msg. is different 1.Currently uniqObjectIds,uniqueRetrievedIds are displayed in two rows in a table view,wanted as a single row 2.How to combine multiple event in a single query if there is no common key .   index= "" source IN ("") "uniqObjectIds" OR "data retrieved for Ids" | spath output=uniqObjectIds path=uniqObjectIds{} | spath output=uniqueRetrievedIds path=uniqueRetrievedIds{} | eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | eval split_field= split(_raw, "Z\"}") | mvexpand split_field | rex field=split_field "objectIdsCount=(?<objectIdsCount>[^,]+)" | rex field=split_field "uniqObjectIdsCount=(?<uniqObjectIdsCount>[^,]+)" | rex field=split_field "recordsCount=(?<recordsCount>[^,]+)" | rex field=split_field "sqsSentCount=(?<sqsSentCount>[^,]+)" | table_time,PST_TIME,objectType,objectIdsCount,uniqObjectIdsCount,recordsCount,sqsSentCount,uniqObjectIds,uniqueRetrievedIds | sort _time desc      ... View more

Hi @gcusello @ITWhisperer  I have same source and index for below two events first event: { [-]    awsRequestId:     hostname:     level: 30    msg: data retrieved for Ids    name:     pid: 8    time:     uniqueRetrievedIds: [ [-    275649    ]    v: 0 } second event: { [-]    awsRequestId:     hostname:     level: 30    msg: unique objectIds    name:     pid: 8    time:     uniqObjectIds: [ [-]      275649    ]    uniqObjectIdsCount: 1    v: 0 } There is no common key in these two events,but want to have in table view 1.Currently uniqObjectIds,uniqueRetrievedIds are displayed in two rows in a table view,wanted as a single row 2.How to combine multiple event in a single query if there is no common key .   index= "" source IN ("") "uniqObjectIds" OR "data retrieved for Ids" | spath output=uniqObjectIds path=uniqObjectIds{} | spath output=uniqueRetrievedIds path=uniqueRetrievedIds{} | eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | eval split_field= split(_raw, "Z\"}") | mvexpand split_field | rex field=split_field "objectIdsCount=(?<objectIdsCount>[^,]+)" | rex field=split_field "uniqObjectIdsCount=(?<uniqObjectIdsCount>[^,]+)" | rex field=split_field "recordsCount=(?<recordsCount>[^,]+)" | rex field=split_field "sqsSentCount=(?<sqsSentCount>[^,]+)" | table_time,PST_TIME,objectType,objectIdsCount,uniqObjectIdsCount,recordsCount,sqsSentCount,uniqObjectIds,uniqueRetrievedIds | sort _time desc      ... View more

Hi @ITWhisperer  THANKS for the above query which worked to get the data from that json in a table form.but data are displayed as duplicate/doble index="" source IN ("") "request body"| spath | spath input=eventBody,eventBody.objectIds{}   ... View more

    Hi Team, First Event where i need to retrieve the uniqObjectIds {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"uniqObjectIds":["275649"],"uniqObjectIdsCount":1,"msg":"unique objectIds","time":"","v":0} below is one event where i want the fields objecttype,objectids,version to retrieve {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"eventBody":{"objectType":"material","objectIds":["275649"],"version":"latest"},"msg":"request body","time":"2023-11-06T22:48:03.330Z","v":0} Wanted to retrieve above two events data in the below query index="" source IN ("") | eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | eval split_field= split(_raw, "Z\"}") | mvexpand split_field | rex field=split_field "objectIdsCount=(?<objectIdsCount>[^,]+)" | rex field=split_field "uniqObjectIdsCount=(?<uniqObjectIdsCount>[^,]+)" | rex field=split_field "recordsCount=(?<recordsCount>[^,]+)" | rex field=split_field "sqsSentCount=(?<sqsSentCount>[^,]+)"|where objectType="material" | table_time,PST_TIME,objectType,objectIdsCount,uniqObjectIdsCount,recordsCount,sqsSentCount | sort _time desc   ... View more