thanks for checking it.
So, here is what i am looking for.
query:
| makeresults
|append [search index="index-name" probe_success instance="https://teams-*" |rex field=_raw "}\s(?\d[-+]?[0-9]*.?[0-9]+)"| dedup 1 instance]
| eval instance1= if((instance == "https://teams-instance1 AND stat == 1), "", "")
| eval instance2= if((instance == "https://teams-instance2 AND stat == 1), "", "")
| eval svg_viz = "
".instance1."
".instance2."
"
| table svg_viz
Here, svg_viz has to run only once after all check has been done replacing the variables in the svg definition. But what happens is that svg gets created for every event and i am not able to consolidate the checks.
... View more