Hi All, I am looking for pie chart which number success & Error events in the search. Below are my 2 query's. Query 1 :- host = servername sourcetype=file index=index_prod "ERROR" | stats count Query 2 :- host = servername sourcetype=file index=index_prod "Success" | stats count Initially i though to extract the field, But the in the event "Error" & "Success" falls on different fields. Can some please suggestion an idea. ... View more

Hi Team, With the below search query I have set the email Alert configuration, To only me as a testing which was working good. index=index_name "Disk Alert 1 sent, Disk utilization at or near capacity" My Quires are 1) I have mentioned, the complete line from the log file is "Disk Alert 1 sent, Disk utilization at or near capacity Partition=log, Usage=98%", So I want the email to trigger if the value is greater then 80% ? How and where this filter need to applied? 2) Alert which I created, I getting emails alerts and can able to open. Same I forward My teammate but he not able to open that, I verified Sharing category is private. In fact while I am creating the Alert I don’t see any option to select as private or public. By default it was Private. So how can I modify that ? 3) In the same alert, I have mentioned my team DL email address instead if my ID when i try the run it is not triggering any email. Could you please me to set email alert to the team to access/view ? Please do let me know if my query is not clear & need any more detail information. You can email me at fine. -Paul ... View more