What i am trying to accomplish is the following; I have 3 search queries. The first one displays a single value that gives me the sum of messages that a service of us recieved and accepted on the service adapter. I also have a query that sums up the messages that got rejected on the service adapter. My third query shows the value of the messages that have been recieved on a different service adapter. Is it possible to create a panel in wich i can check if the first and second query combined have the same value als the last query? I tried to combine the queries with a append of multisearch but i cannot seem to get the result I want. first query: index=foo sourcetype="foo:bw" barAdapter Operation=foo | stats distinct_count(ConversationID) as Total1 second query: index=foo sourcetype="foo:bw" "barAdapter" Operation=foo FromParty=xxx | stats count as Total2 third query: index=foo sourcetype="foo:bw" "Publishing to endpoint Queue" Operation=foo | stats count as Total3 Thank you in advance for any help. ... View more

Hi, Im currently building a dashboard and one of my search strings is the one below. I currently see the values GPS and NIAS but there is a third kind which is a irregular value. Is it possible to make the string ????? put the irregular value in a value displayed by "Other" index=Adapter (GPS OR NIAS)| rex field=_raw "ConversationID=(?.*)" | eval n=substr(bericht,1,3) | chart count(eval(n="GPS")) AS "GPS", count(eval(n="NIA")) AS "NIAS" , ????????? AS "OVERIG" | transpose Thank you ... View more