my query below
(Index=x source=xtype valid) or (index=y source= ytype passed) | eval which=if(match(_raw, " valid"),"valid", "passed") | stats values( which) as msg by manid | stats count(eval(msg=" valid")) as total_ count count(eval(msg= "passed"))
getting out like total count 54 respons count 58
But i want check this condition too
Eval msgconur = mvcount(msg) | where >1
Need to check duration time > 30 count duration time <30 count
My SLA calculating like this 100-(count of duration<30/total count)*100
| stats values( which) as msg count(eval(duration>30)) as gt30 count(eval(duration<30) as lt30 by manid | where mvcount(msg) > 1