index="ss-stg-dkp" cluster_name="*" AND namespace=dcx AND (label_app="composite-*" ) sourcetype="kube:container:main" | rex \"status\":"(?<Http_code>\d+)" | rex \"evtType\":"\"(?<evt_type>\w+)"\" |search evt_type=REQUEST| stats count(eval(Http_code>0)) as "Totalhits" count(eval(Http_code <500)) as "sR"| append [ search index="ss-stg-dkp" cluster_name="*" AND namespace=dcx AND (label_app="composite-*" ) sourcetype="kube:container:main"| rex field=_raw "Status code:"\s(?<code>\d+) |stats count(eval(code =500)) as error]   Hi All I want to add error count in to Totalhits like eval TotalRequest = error+TotalHits It is showing as null value. Please help me to achieve this ... View more

not able to search with any attribute which are having .(dot) like env.cookieSize NOT WORKING ------------------   index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet" | spath status | search status=500 | spath "context.duration" | search "context.duration"="428.70000000006985"| spath "context.env.cookiesSize" | search "context.env.cookiesSize"=7670   WORKING   index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet" | spath status | search status=500 | spath "context.duration" | search "context.duration"="428.70000000006985"   Let me know the solution for this  context: { [-] duration: 428.70000000006985 env.automation-bot: false env.cookiesSize: 7670 env.laneColor: blue } ... View more