I modified this query further
receiverId << this are unique identifier
What i am trying to do is only show result based on the violations > 1
Examples
If Violation > 1 and severity count is 4, 3, then the result should be sev-4
If Violation > 1 and severity count is 3, 3, then the result should be sev-3
If Violation > 1 and severity count is 2, 3, then the result should be sev-3
If Violation > 1 and severity count is 2, 2, then the result should be sev-2
If Violation > 1 and severity count is 2, 1, then the result should be sev-1
If Violation > 1 and severity count is 1, `, then the result should be sev-1
Below is hte modified query
sourcetype=Test Error Error IS_VISIBLE=true
| bucket _time span=10m
| stats dc(receiverId) as receiverIds by _time
| eval sev=case('receiverIds'>10000, "1", 'receiverIds'>2999 and 'receiverIds'<9999, "2", 'receiverIds'>500 and 'receiverIds'<=2999, "3", 'receiverIds'<499, "4")
| eventstats count as VIOLATIONS by sev
| fields _time receiverIds sev
... View more