About rajkskumar

rajkskumar · ‎10-28-2021

I have data in the following structure received for every event. Some events have just one or two sub calls and some have more sub calls. I need to calculate the sum of the total duration. subCalls: [ [-] { [-] completionTimeMs: 69 method: GET statusCode: 200 } { [-] completionTimeMs: 77 method: GET statusCode: 200 } { [-] completionTimeMs: 956 method: POST statusCode: 200 } { [-] completionTimeMs: 201 method: PATCH statusCode: 204 } ] The below search calculates the sum of all the values in all the events instead of every event. Please suggest on how to proceed further. mysearch | eventstats sum(processRelevantFields.eventDetails.subCalls{}.completionTimeMs) as totalDuration | table traceId, totalDuration

rajkskumar · ‎02-10-2021

I need to extract two characters to a new field. The query I have written is able to remove the first 6 characters and it retrieves from 7th character till the end. Data: { type: Identifier value: 1234567890ABCDEF } {\"type\":\"Identifier\",\"value\":\"(?:.{6})(?<idCode>.*?)\"} The query returns "7890ABCDEF" whereas I need only "78". Could someone please help me to fix the issue?

rajkskumar · ‎11-07-2020

Unfortunately, it is not working. I don't get any results with Timechart. With 'Chart', I get the Active and Inactive count for today.

rajkskumar · ‎11-06-2020

I have a chart that displays the Active and Inactive Users for today. I would like to convert this into a timechart which shows data for the selected Period in the Time picker. index=prod | stats latest(_time) as last_seen by customerId | eval status = if(last_seen > relative_time(now(), "-30d@d"),"Active","Inactive") | chart count by status | rename count as "User Count" Please suggest how it could be approached. @FrankVl : You have helped me with the original query. Could you please guide me here as well?

rajkskumar · ‎10-01-2020

We are working on/ developing 4-5 Dashboards with around 10 Charts in each Dashboard. When we work on multiple Dashboards, we frequently face the Maximum Disk Usage error. And, there are also 10+ Alerts running every day and the Search results are configured to be stored for 24 hours. I am not sure what is the root cause of this error and where to optimize? 1. Due to data not readily available, we calculate the Country and Continent based on geo-location. The Country code will be delivered with the Events in the future. This Calculation happens for every event as part of the base search. 2. Number of Events: The dashboards are set to 'last 30 days' as default. Due to this, the Events to be handled and the size are big. 3. Alerts / Past search jobs: The Search results of the Alerts are stored for 24 hours. And, the Search job results are configured to be stored for 10 minutes. The searches related to Dashboard and the Alerts are mostly reporting/monitoring in nature. Hence, mostly aggregating the events and the final Search results would not be big. Could someone please clarify which would be causing this Memory issue? We could always request more disk space for the Developers who create the Dashboards. But, we would like to avoid the same issue coming up to Users as well. Hence, I would like to understand what could be the root cause of this issue.

rajkskumar · ‎09-30-2020

The Main search is a complex base search query. The Subsearch is used to filter out the elements for this specific chart. The result includes events which has null fields

rajkskumar · ‎09-30-2020

I have the following query used to build a chart. Sometimes, the incoming events do not have the fields set. How could these events with null could be excluded in a Subsearch? index=prod | search processRelevantFields.processName="SessionExecution"|search prod.customerId=* prod.productId=* | timechart dc(customer.ciamId) as "Active Users" I have tried with "search <fieldName> =*" as given above. But this is not working. Please guide on how this could be implemented?

rajkskumar · ‎09-28-2020

Could you please suggest to me how to add the percentage of Errors against Total events? index=ladedienst-prod | eval errorCount=if(isnull('services.errorCode'),0,1) | stats count as "Total", sum(errorCount) as "Error Count" by services.serviceProviderName I have tried with eval before the stats command. But, it was not working.

rajkskumar · ‎09-28-2020

It was not working. I have put the field name within Double quotes. Now, everything gets counted as error. index=prod | eval error=if(isnull("services.errorCode"),0,1) | stats count as "Total", sum(error) as "Error Count" by services.serviceProviderName Instead of isnull, I also tried with checking the length, if it is zero. That is not working as well. Total Event count and Error count is coming out the same.

rajkskumar · ‎09-28-2020

Tried with single quotes, unfortunately, getting the same results.

rajkskumar · ‎09-28-2020

I am trying to create a table which has Total number of events and the Error count in the events. The field 'services.errorCode' will be filled if there is an error, it will not be filled if the event is a success. The below query gives me the correct count of Total, but the Error Count is always 0. I have verified in the Events and there are many events with the field errorCode filled. index=prod | stats count as "Total", count(eval("services.errorCode"!=null)) as "Error Count" by services.serviceProviderName Please guide me on how this could be done.

rajkskumar · ‎08-18-2020

Hi @FrankVl, Thank you very much for your support. This is working as expected. However, I need to add another condition to the "if" clause and I tried with the following. All the users are shown as "Inactive". Could you please point out the issue in the conditions? index=prod | stats latest(_time) as last_seen by customerId, processName | eval status = if(processName=="Execution" AND (last_seen > relative_time(now(), "-30d@d")),"Active","Inactive") index=prod | stats latest(_time) as last_seen by customerId | eval status = if(match(processName,"Execution") AND (last_seen > relative_time(now(), "-30d@d")),"Active","Inactive")

rajkskumar · ‎08-18-2020

I want to build a Chart with two values. Inactive Users based on Customer ID and the Active Users who have used the service in the last 30 days. index=prod earliest=-30d AND latest=now | eval Total = mvdedup(customerId) | timechart span=1d dc(customerId) as "Active Users" The above code gives me the Chart for Active Users in the last 30 days. From All time data I want to get the count of Total Users and then derive the Inactive users. (Inactive = Total users - Active users). Please help me to rewrite the query to generate the required data.

Posts	13
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎08-18-2020

Online Status	Offline
Date Last Visited	‎11-01-2021 09:24 AM

Calculate sum of duration for Sub calls

Field extraction - only 2 characters

Active vs Inactive Users in a Timechart

What causes Maximum Disk Usage error?

Exclude Null in subsearch

Total and Error count by Provider

Inactive users vs active users in the last 30 days

Calculate sum of duration for Sub calls

Field extraction - only 2 characters

Re: Active vs Inactive Users in a Timechart

Active vs Inactive Users in a Timechart

What causes Maximum Disk Usage error?

Re: Exclude Null in subsearch

Exclude Null in subsearch

Re: Total and Error count by Provider

Re: Total and Error count by Provider

Re: Total and Error count by Provider

Total and Error count by Provider

Re: Inactive users vs active users in the last 30 ...

Inactive users vs active users in the last 30 days