@ITWhisperer  Thanks a lot!! ... View more

Thanks! You are correct and on dummy data it is working perfectly fine.  Let me share the exact event structure with dummy data on platform index (platform-va6) having final status : snap attached for reference. upon clicking on show as _raw text -    _raw text =========== {"timestamp":"2024-03-30T11:28:58.438Z","logger_name":"MessageHandler","thread_name":"threadPoolTaskExecutor-22","level":"INFO","serviceArchPath":"worker","process":"NA","message":"Marked request as succeed. {\"status\":\"PREDICT_SUCCESS\",\"message\":null}, critical Path: {\"requestStartTime\":1711797346337,\"operationsInCriticalPath\":{\"PREDICT:Feature:01\":{\"queue_overhead_ms\":59,\"sdk_overhead_ms\":25,\"process_time_ms\":432265,\"total_time_ms\":432349},\"PREDICT:Feature:02\":{\"queue_overhead_ms\":68,\"sdk_overhead_ms\":17,\"process_time_ms\":358611,\"total_time_ms\":358697},\"PLAT_CORE:Orchestrator\":{\"queue_overhead_ms\":142,\"process_time_ms\":158,\"total_time_ms\":300,\"hbase_overhead_in_ms\":136},\"PLAT_CORE:inference-core\":{\"total_time_ms\":8,\"hbase_overhead_in_ms\":5},\"PREDICT:Feature:03\":{\"queue_overhead_ms\":78,\"sdk_overhead_ms\":5,\"process_time_ms\":663,\"total_time_ms\":747}},\"currentOperationTimingInfo\":{},\"total_time_ms\":792101}","x-request-id":"testabc-123","x-service-id":"testID","x-api-key":"test-client","x-client-id":"test-client","invocation_id":"test1","x-user-id":"test@abc.com","x-access-protected-e":"true","trace_id":"testabc-0000","trace_flags":"00","span_id":"b1"}   ... View more

Thanks! @ITWhisperer  This is really helpful. The only problem is - The shared query I tried and it is not able to fetch the final status as succeed or failed. As per sample event , platform index has message field which is having this text as marked request as succeed or marked request as failed. attaching snap for reference. ... View more

Thanks for help!!! The initial query cannot be replaced with "share query" because the backend engine processes "Logtext - 'target language count'" with a numeric count value for each request/process. Only a subset of these requests triggers an API call, marked as true. Consequently, the engine proceeds to process subsequent logtext events for those requests where the API call value is true. Therefore, my objective is to capture all such requests with a true API call and obtain the corresponding target language count values. This allows me to multiply the language count by the total count of processed requests. Your suggested query retrieves all events across all processed requests where the language count was processed. Additionally, there's another index, the "platform index," to which the engine processes events with the final request status marked as either "succeed" or "failed." In line with my previous objective, I aim to extract the final status from this index for requests where the API call was true. Consequently, I am attempting to integrate the initial query with a new query for the platform index. Below are sample events for reference from both of indexes when running the search query: My Purpose as per Initial shared query : I need to identify request IDs with "API Call" as true, get the count of "Target_Lang" for these IDs, calculate total API calls by multiplying num_lang count with request ID count, and further fetch final status from platform index for filtered request IDs, and determine the count of failed/successful API calls based on status.     Sub_Query_1: index=default-va6 sourcetype="myengine-stage" ("API call is True for MyEngine" OR "Target language count") "testabc-123" Event-1: 2024-03-29 12:25:15,276 _engine - INFO - process - request_id=testabc-123 - user-id=test01 Target language count 1 Event-2: 29/03/2024 17:55:14.991 _engine - INFO - process - request_id=testabc-123 - user-id=test01 API call is True for MyEngine Sub_Query_2: index=platform-va6 sourcetype="platform-ue*" "testabc-123" "Marked request as" 29/03/2024 18:01:20.556 message: Marked request as succeed. {"status":"PREDICT_SUCCESS"} x-request-id: testabc-123       ... View more