Hi I'm trying to search for multiple strings within all fields of my index using fieldsummary, e.g. index=centre_data | fieldsummary | search values="*DAN012A Dance*" OR values="*2148 FNT004F Nutrition Technology*" | table fields Is there another/better way to perform this search or modify this query so that I can add the field where the "string" appears in the event, as well as include other output fields of my choosing? e.g. User, Date, FieldWhereStringAppears, Object I have tried a number of things and can't work it out. Many thanks ... View more

Hi I'm searching on an internet usage index for events that contain a particular word somewhere in the domain. For example the word could be "edublogs". From the result, I need to sum the total of bytes downloaded for all events returned. The problem I'm having is needing to calculate a distinct count of centers and a distinct count of userids where the domain name only begins with "edublogs", e.g. "edublogs.com" and not when it doesn't, e.g.  "accountsedublogs.com". I know this example is wrong but can someone please help me with how I would change it to achieve the outcome below? index=searchdata domain="*edublogs*" | stats count dc(centre) AS distinctCenters | stats count dc(userid) AS distinctUserids | stats sum(bytes) AS totalBytes by domain | table domain totalBytes, distinctCenters, distinctUserids My desired results would look something like... domain totalBytes distinctCenters distinctUserids Senior 50000 15 321 Many thanks ... View more

Hi I was hoping someone might be able to help me with what I'm trying to achieve. I've tried to work this out but with limited knowledge of queries I'm struggling. I have a very basic query (below) which outputs the following data from my index... index=centredata (domain="*.create.com*" OR domain="*.puzzle.com*") sc_status=200 | table centreid, domain, groupid, userid centreid domain             groupid    userid 0123       create.com     Student    tiyud0 0123       create.com     Staff          dbega0 0456       create.com     Staff          oghjr6 0123       puzzle.com     Student   qsadh2 0456       puzzle.com     Staff         srthg5 0123       create.com     Student   klghg2 0456       create.com     Staff         wrdv6 0456       create.com     Student   xcgar4 0123       create.com     Student   tiyud0 0456       create.com     Staff         oghjr6 0123       puzzle.com     Student   klghg2 0456       puzzle.com     Staff         ykszd9 0123       create.com     Staff         dbega0 0456       puzzle.com     Staff         oghjr6 0123       puzzle.com     Student   tiyud0 0123       create.com     Staff         sdgxc0 The output I'm wanting is the count of distinct userids for both groupid types (staff and student) by domain and centreid. An example of how I need it to look is as follows... centreid domain            staff       student 0123       create.com     2             2 0456       create.com     2             1 0123       puzzle.com     0             3 0456       puzzle.com     3             0 Many thanks in advance 🙂 ... View more