Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About wanda619
wanda619
Path Finder
Member since:
08-02-2022
03-30-2023
Community Statistics
| Posts | 31 |
| Solutions | 0 |
| Karma Given | 23 |
| Karma Received | 0 |
| Member Since | 08-02-2022 |
Activity Feed
- Posted Re: How to set a report hourly for time frame between 26th to 5th of each month? on Splunk Search. 11-03-2022 07:56 AM
- Karma Re: How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered for gcusello. 11-02-2022 06:29 AM
- Karma Re: How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered for richgalloway. 11-02-2022 06:29 AM
- Posted Re: How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered on Alerting. 11-02-2022 06:08 AM
- Posted Re: how can i schedule a cron job only once? for example the alert should stop once a condition is triggered on Alerting. 11-02-2022 05:05 AM
- Posted How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered on Alerting. 11-01-2022 05:56 PM
- Karma Re: How to set a report hourly for time frame between 26th to 5th of each month? for isoutamo. 10-19-2022 11:10 AM
- Posted Re: How to set a report hourly for time frame between 26th to 5th of each month? on Splunk Search. 10-19-2022 08:41 AM
- Karma Re: how to set an alert running every day hourly? ex - if new transactions /events occur alert the user for richgalloway. 10-19-2022 06:33 AM
- Posted Re: how to set an alert running every day hourly? ex - if new transactions /events occur alert the user on Splunk Search. 10-18-2022 09:12 AM
- Posted How to set an alert running every day hourly? on Splunk Search. 10-18-2022 07:58 AM
- Posted Re: How to set a report hourly for time frame between 26th to 5th of each month? on Splunk Search. 10-18-2022 06:32 AM
- Karma Re: How to set a report hourly for time frame between 26th to 5th of each month? for johnhuang. 10-17-2022 12:32 PM
- Karma Re: How to set a report hourly for time frame between 26th to 5th of each month? for jdunlea. 10-17-2022 12:32 PM
- Posted How to set a report hourly for time frame between 26th to 5th of each month? on Splunk Search. 10-12-2022 09:32 AM
- Karma Re: How can I hide '_time' field from report table? for richgalloway. 09-22-2022 01:39 PM
- Posted How can I hide '_time' field from report table? on Splunk Search. 09-22-2022 08:46 AM
- Tagged How can I hide '_time' field from report table? on Splunk Search. 09-22-2022 08:46 AM
- Posted Re: How can I sort results for previous week and current week in two seperate columns? on Splunk Search. 09-20-2022 08:12 AM
- Posted Re: How can I sort results for previous week and current week in two seperate columns? on Splunk Search. 09-14-2022 09:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-03-2022
07:56 AM
@isoutamo is their a way to limit this alert once per day? I tried using throttle and supressing it for once a day. is thier some other way?
... View more
11-02-2022
06:08 AM
@gcusello right now the alert is set in such way that report is being sent every hour, i am trying to find a way ,so that it sends one report per day. cron expression i am using is 0 * * * *
... View more
11-02-2022
05:05 AM
@johnhuang yes specifically looking for one time use alert,, since now it i giving alert every hour. I am looking to set alert once at the beginning
... View more
11-01-2022
05:56 PM
right now i have a cron expression like this - 0 * * * *
so the report is sent out every hour. How can i generate the report only once when the condition is triggered.
Thanks!
... View more
Labels
- Labels:
-
alert action
-
alert condition
-
cron
-
email
10-19-2022
08:41 AM
@johnhuang if we want to set the alert for 365 days a year, hourly? how to acheive that?
... View more
10-18-2022
09:12 AM
@richgalloway I want to set up an automated alert on the report , i guess we can use cron expression but not sure how
... View more
10-18-2022
07:58 AM
how to set an alert running every day hourly?
ex - if new transactions /events occur alert the user
... View more
10-18-2022
06:32 AM
@jdunlea if we want to set the alert for 365 days a year, hourly? how to acheive that?
... View more
10-12-2022
09:32 AM
How to set a report hourly for time frame between 26th to 5th of each month?
... View more
Labels
- Labels:
-
stats
-
timechart
-
transaction
09-22-2022
08:46 AM
09-20-2022
08:12 AM
@yuanliu when i try to search itby the above code you mentioned, I did not get the errors i needed as it is blanking and giving 0 outputs on results column.
... View more
09-14-2022
09:58 AM
@yuanliu I am having this error when I am trying to use the above code:
... View more
09-13-2022
12:07 PM
@yuanliu The data is collected daliy as there are daily transactions and the error are shown daily
... View more
09-09-2022
07:55 AM
Hi Folks, How can i display the results for 2022-09-02 in Result_Prev column and 2022-09-09 in Result column and keeping the other columns same. Calculating Percent difference from a this week to the previous week results. any help is appreciated. Thank you !
... View more
Labels
- Labels:
-
field extraction
-
fields
-
lookup
-
stats
-
timechart
08-24-2022
11:59 AM
@yuanliu This is the basic code from which I am trying to get the stats for previous week. index=sample sourcetype=ABC Table ErrorCode!=0 | `DedupDHI` | lookup Table_1 LicenseKey OUTPUT CustomerName,FriendlyName | stats count as Result by CustomerName, ErrorCode | eval PercentOfTotal=100 | append [search index=sample sourcetype=ABC Table ErrorCode!=0 | lookup Table_1 LicenseKey OUTPUT CustomerName | eval CustomerName=coalesce(CustomerName,LicenseKey) | stats count as Result by CustomerName | eval ErrorCode="Total", PercentOfTotal=100] | lookup Table_2 ErrorCode OUTPUT Description | lookup Table_1 LicenseKey OUTPUT CustomerName | eval CustomerName=coalesce(CustomerName,LicenseKey) | eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update Table_2")+")", ErrorCode) | fields CustomerName, Error, Result | sort CustomerName, Error Output from above code - CustomerName Error Result ABC 1003 (Invalid Birth Year) 1 ABC 1013 (Invalid Drivers License Format) 10 ABC 1023 (Invalid Name) 2 ABC 1027 (Invalid UnderwritingState) 118 ABC 1305 (Unable to connect to data provider) 1 ABC Total 132 XYZ 1023 (Invalid Name) 12 XYZ 1201 (Lookback Date Not Set / Offset = 0) 3 XYZ 1305 (Unable to connect to data provider) 8 XYZ Total 23 PQR 1027 (Invalid UnderwritingState) 17 PQR 9999 (Timeout expired (9999)) 1 PQR Total 18 QPR 1003 (Invalid Birth Year) 1 QPR 1013 (Invalid Drivers License Format) 3 QPR 1023 (Invalid Name) 9 QPR 1026 (Drivers License Number is a required field) 2 QPR 9999 (Timeout expired (9999)) 5 QPR Total 20 Based on this result I am trying to calculate the stats for previous week as results for previous week. Unfornunatley, don't have ready- to-share data. But the results column is the error code for a particular customer for this week; I want to get a column where i could see results for previous week. Hope this helps?
... View more
08-22-2022
07:26 AM
@yuanliu so I tried another way - here is my code - index=test sourcetype=dhi:testdata ErrorCode!=0 | `DedupDHI` | lookup table1 LicenseKey OUTPUT CustomerName,FriendlyName | eval CustomerName=coalesce(CustomerName,LicenseKey) | stats count as Result by CustomerName, ErrorCode | eventstats sum(Result) as Total by CustomerName | eval PercentOfTotal = round((Result/Total)*100,3) | streamstats current=f latest(Result) as Result_Prev by Errorcode,CustomerName | eval PercentOfTotal=100 | append [search index=test sourcetype=dhi:testdata ErrorCode!=0 | lookup table1 LicenseKey OUTPUT CustomerName | eval CustomerName=coalesce(CustomerName,LicenseKey) | stats count as Result by CustomerName | eval ErrorCode="Total", PercentOfTotal=100] | lookup table2 ErrorCode OUTPUT Description | lookup table1 LicenseKey OUTPUT CustomerName | eval CustomerName=coalesce(CustomerName,LicenseKey) | eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update table2")+")", ErrorCode) | fields CustomerName, Error, Result,Result_Prev | sort CustomerName, Error Trying to calculate the output for previous week results (retreving stats for previous week) it, the output seems to be like this - CustomerName Error Result PercentOfTotal Result_Prev abc 1003 (Invalid Birth Year) 1 0.952 abc 1006 (Invalid UnderwritingState) 1 0.952 abc 1013 (Invalid Drivers License Format) 11 10.476 abc 1023 (Invalid Name) 2 1.905 abc 1027 (Invalid UnderwritingState) 80 76.19 abc 1305 (Unable to connect to data provider) 10 9.524 abc Total 105 100 abc2 1023 (Invalid Name) 16 57.143 abc2 1201 (Lookback Date Not Set / Offset = 0) 2 7.143 abc2 1305 (Unable to connect to data provider) 10 35.714 abc2 Total 28 100 abc3 1027 (Invalid UnderwritingState) 15 93.75 abc3 9999 (Timeout expired (9999)) 1 6.25 abc3 Total 16 100
... View more
08-21-2022
07:03 PM
@yuanliu The Previous Week Results output shows incorrect values. The code I am trying shows incorrect values. The results column is the calculation for error codes for each customer for current week. I want to calculate the Results for previous week, so that i can also calculate Percentage difference further. did this clarify?
... View more
08-19-2022
08:47 AM
I have spent days working on this, can someone help? how to populate previous week results? Also there are different license keys for same errors that is why it is showing 2 entries.
I have the following code
index=test sourcetype=dhi:testdata ErrorCode!=0 | `DedupDHI` | bucket _time span=1w | lookup table1 LicenseKey OUTPUT CustomerName | eval CustomerName=coalesce(CustomerName,LicenseKey) | stats count as Result by CustomerName,ErrorCode,_time | eventstats sum(Result) as Total by CustomerName | eval PercentOfTotal = round((Result/Total)*100,3) | streamstats current=f latest(Result) as Result_Prev by CustomerName,ErrorCode | eval PercentDifference = round(((Result/Result_Prev)-1)*100,2) | fillnull value="0" | append [ search index=test sourcetype=dhi:testdata ErrorCode!=0 | `DedupDHI` | lookup table1 LicenseKey OUTPUT CustomerName | eval CustomerName=coalesce(CustomerName,LicenseKey) | stats count as Result by CustomerName | eval ErrorCode="Total", PercentOfTotal=100] | fillnull value="0" | lookup table2 ErrorCode OUTPUT Description | lookup table1 LicenseKey OUTPUT CustomerName | eval CustomerName=coalesce(CustomerName,LicenseKey) | eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update table2")+")", ErrorCode) | rename Result_Prev as "Previous Week Results", PercentDifference as " Percent Difference", PercentOfTotal as "Percent of Total" | fields CustomerName, Error, Result,"Previous Week Results", " Percent Difference" , "Percent of Total" | sort CustomerName, Error, PercentDifference
OUTPUT -
CustomerName
Error
Result
Previous Week Results
Percent Difference
Percent of Total
_time
customer_1
1002 (Invalid Address State Code. The two digit state code is invalid)
4
0
0
3.361
2022-08-12T00:00:00.000-0500
customer_1
1003 (Invalid Birth Year)
1
0
0
0.84
2022-08-12T00:00:00.000-0500
customer_1
1006 (Invalid UnderwritingState)
1
0
0
0.84
2022-08-12T00:00:00.000-0500
customer_1
1013 (Invalid Drivers License Format)
12
0
0
10.084
2022-08-12T00:00:00.000-0500
customer_1
1013 (Invalid Drivers License Format)
1
12
-91.67
0.84
2022-08-19T00:00:00.000-0500
customer_1
1023 (Invalid Name)
3
0
0
2.521
2022-08-12T00:00:00.000-0500
customer_1
1027 (Invalid UnderwritingState)
87
0
0
73.109
2022-08-12T00:00:00.000-0500
customer_1
1027 (Invalid UnderwritingState)
1
87
-98.85
0.84
2022-08-19T00:00:00.000-0500
customer_1
1305 (Unable to connect to data provider)
9
0
0
7.563
2022-08-12T00:00:00.000-0500
customer_1
Total
119
0
0
100
1969-12-31T18:00:00.000-0500
customer_2
1023 (Invalid Name)
16
0
0
55.172
2022-08-12T00:00:00.000-0500
customer_2
1201 (Lookback Date Not Set / Offset = 0)
1
0
0
3.448
2022-08-12T00:00:00.000-0500
customer_2
1305 (Unable to connect to data provider)
11
0
0
37.931
2022-08-12T00:00:00.000-0500
customer_2
1305 (Unable to connect to data provider)
1
11
-90.91
3.448
2022-08-19T00:00:00.000-0500
customer_2
Total
29
0
0
100
1969-12-31T18:00:00.000-0500
customer_3
1023 (Invalid Name)
3
0
0
20
2022-08-12T00:00:00.000-0500
customer_3
1027 (Invalid UnderwritingState)
11
0
0
73.333
2022-08-12T00:00:00.000-0500
customer_3
9999 (Timeout expired (9999))
1
0
0
6.667
2022-08-12T00:00:00.000-0500
customer_3
Total
15
0
0
100
1969-12-31T18:00:00.000-0500
customer_4
1003 (Invalid Birth Year)
1
0
0
3.846
2022-08-12T00:00:00.000-0500
customer_4
1013 (Invalid Drivers License Format)
5
0
0
19.231
2022-08-12T00:00:00.000-0500
customer_4
1013 (Invalid Drivers License Format)
1
5
-80
3.846
2022-08-19T00:00:00.000-0500
customer_4
1023 (Invalid Name)
14
0
0
53.846
2022-08-12T00:00:00.000-0500
customer_4
1026 (Drivers License Number is a required field)
3
0
0
11.538
2022-08-12T00:00:00.000-0500
customer_4
9999 (Timeout expired (9999))
1
0
0
3.846
2022-08-12T00:00:00.000-0500
customer_4
9999 (Timeout expired (9999))
1
1
0
3.846
2022-08-19T00:00:00.000-0500
customer_4
Total
26
0
0
100
1969-12-31T18:00:00.000-0500
... View more
- Tags:
- output
- splunk-search
08-17-2022
08:50 AM
@bowesmana Correct the basic search is same for both. The where clause I believe works but it messes up with the output for Error, as It does not allows me to show all the other error code output. for example - CustomerName Error Result Previous Week Results Percent Difference Percent of Total _time Client1 1003 (Invalid Birth Year) 1 2 -50 0.885 2022-08-17T00:00:00.000-0500 Client1 1023 (Invalid Name) 1 2 -50 0.885 2022-08-17T00:00:00.000-0500 Client1 1027 (Invalid UnderwritingState) 2 83 -97.59 1.77 2022-08-17T00:00:00.000-0500 Client1 Total 113 0 0 100 1969-12-31T18:00:00.000-0500 Client2 1023 (Invalid Name) 1 11 -90.91 4.348 2022-08-17T00:00:00.000-0500 Client2 Total 23 0 0 100 1969-12-31T18:00:00.000-0500 Client3 1027 (Invalid UnderwritingState) 1 10 -90 7.143 2022-08-17T00:00:00.000-0500 Client3 Total 14 0 0 100 1969-12-31T18:00:00.000-0500 Client4 1013 (Invalid Drivers License Format) 1 8 -87.5 3.846 2022-08-17T00:00:00.000-0500 Client4 Total 26 0 0 100 1969-12-31T18:00:00.000-0500 Client5 Total 2 0 0 100 1969-12-31T18:00:00.000-0500 Client6 Total 8 0 0 100 1969-12-31T18:00:00.000-0500 Client7 Total 1 0 0 100 1969-12-31T18:00:00.000-0500 Client8 1013 (Invalid Drivers License Format) 2 3 -33.33 1.681 2022-08-17T00:00:00.000-0500 Client8 1023 (Invalid Name) 1 8 -87.5 0.84 2022-08-17T00:00:00.000-0500 Client8 1027 (Invalid UnderwritingState) 4 95 -95.79 3.361 2022-08-17T00:00:00.000-0500 Client8 Total 119 0 0 100 1969-12-31T18:00:00.000-0500 Client9 1013 (Invalid Drivers License Format) 15 165 -90.91 7.772 2022-08-17T00:00:00.000-0500 Client9 Total 193 0 0 100 1969-12-31T18:00:00.000-0500 Client10 Total 6 0 0 100 1969-12-31T18:00:00.000-0500 Client11 Total 1197 0 0 100 1969-12-31T18:00:00.000-0500 The Client 5,6,7 as well as 10,11 just shows up with total.
... View more
08-16-2022
08:45 AM
@martinpu I am facing issues in getting previous week results, any other alternative than this, My code - | bucket _time span=1w
| lookup table_1 LicenseKey OUTPUT CustomerName
| eval CustomerName=coalesce(CustomerName,LicenseKey)
| stats count as Result by CustomerName, ErrorCode
| eventstats sum(Result) as Total by CustomerName
| eval PercentOfTotal = round((Result/Total)*100,3)
| sort - _time
| streamstats current=f latest(Result) as Result_Prev by CustomerName
| eval PercentDifference = round(((Result/Result_Prev)-1)*100,2)
| fillnull value="0"
| append
[ search index=abc= xyz:123 ErrorCode!=0
| `DedupDHI`
| lookup Table_1 LicenseKey OUTPUT CustomerName
| eval CustomerName=coalesce(CustomerName,LicenseKey)
| stats count as Result by CustomerName
| eval ErrorCode="Total", PercentOfTotal=100]
| fillnull value="0"
| lookup Table_2 ErrorCode OUTPUT Description
| lookup Table_1 LicenseKey OUTPUT CustomerName
| eval CustomerName=coalesce(CustomerName,LicenseKey)
| eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update Table_2")+")", ErrorCode)
| rename Result_Prev as "Previous Week Results", PercentDifference as " Percent Difference", PercentOfTotal as "Percent of Total"
| fields CustomerName, Error, Result,"Previous Week Results", " Percent Difference" , "Percent of Total"
| sort CustomerName, Error, PercentDifference Output - CustomerName Error Result Previous Week Results Percent Difference Percent of Total AIG Private Client Group 1002 (abc) 4 0 0 3.252 AIG Private Client Group 1003 (cxz) 2 4 -50 1.626 AIG Private Client Group 1013 (Invalid Format) 12 4 200 9.756 AIG Private Client Group 1023 (Invalid Name) 3 4 -25 2.439 AIG Private Client Group 1027 (Invalid ) 102 4 2450 82.927 AIG Private Client Group Total 123 0 0 100 AIICO 1023 (Invalid Name) 8 0 0 38.095 AIICO 1201 1 8 -87.5 4.762 AIICO 1305 12 8 50 57.143 AIICO Total 21 0 0 100 Acceptance 1023 (Invalid Name) 3 0 0 27.273 Acceptance 1027 8 3 166.67 72.727 Acceptance Total 11 0 0 100 The Previous Week Results column is appending 4, if noticed which is wrong. any suggestions to solve this ?
... View more
08-16-2022
06:59 AM
@bowesmana is there any other alternative than using bucket_time span? to acheive the result
... View more
08-15-2022
11:21 AM
Hi community,
I have to calculate previous week result, based on that, I calculate Percent difference with this weeks results. I have following code, but not able to get previous week result right.
My Code :
| bucket _time span=1w
| lookup table_1 LicenseKey OUTPUT CustomerName
| eval CustomerName=coalesce(CustomerName,LicenseKey)
| stats count as Result by CustomerName, ErrorCode
| eventstats sum(Result) as Total by CustomerName
| eval PercentOfTotal = round((Result/Total)*100,3)
| sort - _time
| streamstats current=f latest(Result) as Result_Prev by CustomerName
| eval PercentDifference = round(((Result/Result_Prev)-1)*100,2)
| fillnull value="0"
| append
[ search index=abc= xyz:123 ErrorCode!=0
| `DedupDHI`
| lookup Table_1 LicenseKey OUTPUT CustomerName
| eval CustomerName=coalesce(CustomerName,LicenseKey)
| stats count as Result by CustomerName
| eval ErrorCode="Total", PercentOfTotal=100]
| fillnull value="0"
| lookup Table_2 ErrorCode OUTPUT Description
| lookup Table_1 LicenseKey OUTPUT CustomerName
| eval CustomerName=coalesce(CustomerName,LicenseKey)
| eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update Table_2")+")", ErrorCode)
| rename Result_Prev as "Previous Week Results", PercentDifference as " Percent Difference", PercentOfTotal as "Percent of Total"
| fields CustomerName, Error, Result,"Previous Week Results", " Percent Difference" , "Percent of Total"
| sort CustomerName, Error, PercentDifference
Output -
CustomerName
Error
Result
Previous Week Results
Percent Difference
Percent of Total
AIG Private Client Group
1002 (abc)
4
0
0
3.252
AIG Private Client Group
1003 (cxz)
2
4
-50
1.626
AIG Private Client Group
1013 (Invalid Format)
12
4
200
9.756
AIG Private Client Group
1023 (Invalid Name)
3
4
-25
2.439
AIG Private Client Group
1027 (Invalid )
102
4
2450
82.927
AIG Private Client Group
Total
123
0
0
100
AIICO
1023 (Invalid Name)
8
0
0
38.095
AIICO
1201
1
8
-87.5
4.762
AIICO
1305
12
8
50
57.143
AIICO
Total
21
0
0
100
Acceptance
1023 (Invalid Name)
3
0
0
27.273
Acceptance
1027
8
3
166.67
72.727
Acceptance
Total
11
0
0
100
The Previous Week Results column is appending 4, if noticed which is wrong. any suggestions to solve this ?
... View more
08-09-2022
11:16 AM
Client
Error
Error Results
Error ResultsPrevious week
Percent of Total
PercentDifference
abc
1003
2
0
12.5
0
abc
1003
3
12.5
0
abc
1013
1
2
342
-50
abc
1027
3
3
5
0
abc
1027
5
xyz
43
zyz
abc
1013
2
zyz
432
et
abc
Total
16
zyds
423
tert
My code is --
| bucket _time span=1w
| stats count as Result by LicenseKey, Error_Code
| eval Client=coalesce(Client,LicenseKey)
| eventstats sum(Result) as Total by Client
| eval PercentOfTotal = round((Result/Total)*100,3)
| sort - _time
| streamstats current=f latest(Result) as Result_Prev by LicenseKey
| eval PercentDifference = round(((Result/Result_Prev)-1)*100,2)
| fillnull value="0"
| append
[ search index=abc sourcetype=yxx source= bff ErrorCode!=0
| `DedupDHI`
| lookup abc LicenseKey OUTPUT Client
| eval Client=coalesce(Client,LicenseKey)
| stats count as Result by Client
| eval ErrorCode="Total", PercentOfTotal=100]
| lookup xyz_ErrorCodes ErrorCode OUTPUT Description
| lookup uyz LicenseKey OUTPUT Client
| eval Client=coalesce(Client,LicenseKey)
| eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update xyz_ErrorCodes")+")", ErrorCode)
| fields Client, Error, Result, PercentOfTotal, PercentDifference, Error results previous week
| sort CustomerName, Error, PercentDifference
Still not able to figure out the duplicate row issue, single row for one each error combined with total.
any suggestions please?
... View more
08-08-2022
02:09 PM
hi @gcusello Client Error Error Results Error ResultsPrevious week Percent of Total PercentDifference abc 1003 2 0 12.5 0 abc 1003 3 12.5 0 abc 1013 1 2 342 -50 abc 1027 3 3 5 0 abc 1027 5 xyz 43 zyz abc 1013 2 zyz 432 et abc Total 16 zyds 423 tert My code is -- | bucket _time span=1w | stats count as Result by LicenseKey, Error_Code | eval Client=coalesce(Client,LicenseKey) | eventstats sum(Result) as Total by Client | eval PercentOfTotal = round((Result/Total)*100,3) | sort - _time | streamstats current=f latest(Result) as Result_Prev by LicenseKey | eval PercentDifference = round(((Result/Result_Prev)-1)*100,2) | fillnull value="0" | append [ search index=abc sourcetype=yxx source= bff ErrorCode!=0 | `DedupDHI` | lookup abc LicenseKey OUTPUT Client | eval Client=coalesce(Client,LicenseKey) | stats count as Result by Client | eval ErrorCode="Total", PercentOfTotal=100] | lookup xyz_ErrorCodes ErrorCode OUTPUT Description | lookup uyz LicenseKey OUTPUT Client | eval Client=coalesce(Client,LicenseKey) | eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update xyz_ErrorCodes")+")", ErrorCode) | fields Client, Error, Result, PercentOfTotal, PercentDifference, Error results previous week | sort CustomerName, Error, PercentDifference Still not able to figure out the duplicate row issue, single row for one each error combined with total. any suggestions please?
... View more
