below is my search string...
index=system_details | table "System ID",System_Name,Domain,"Task Priority","AM Fixed Fee"| rename "Task Priority" as tp | rename "AM Fixed Fee" AS fee | eval Slab=if((fee*12)>=600000,2,if((fee*12)<=400000,3,2.5)) | join "System ID" [search index=pro_tracker | rename "Product Name" as "System ID" | rename "Task Priority" as tp | eval P=if(tp="2-Major (B)" OR tp="1-Critical (A)",1,0) | stats sum(P) , sum("I8 Actual minutes") by "System ID",tp | rename sum("I8 Actual minutes") as down , sum(P) as countI| eval workhrs=[ search index=system_details | eval M=relative_time(now(),"-1d@d") | eval mh=strftime(M,"%Y-%m") | eval Flg=if(mh=Month,'Work Days',0) | eventstats max(Flg) as max | return $max]| eval downtime=(down-if((countI<2 OR workhrs*60=0),0,(down-(workhrs*60)+((workhrs*60)*POW(((workhrs*60)-1)/(workhrs*60),down)))))/60 | eval Availability=if(downtime>workhrs,0,(1-downtime/workhrs)) | where (tp="2-Major (B)" OR tp="1-Critical (A)")| eval scslab=if('2017_11'="BL","None",pow((('2017_11'-Availability)*100),2)*0.01)]
in place of '2017_11' it should automatically pickup the value of the column ('2017_11') corresponding to "System ID"
Thanks,
Ganesh Shetty
... View more