It's a query for a staked column chart.
index=myCompIn source="/locatedin/mySrc.log" "Reply Back" "CAT-IN " "SOME STUFF" | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false true false)"] | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false false true)"]|timechart span=1d count AS aTXN | join _time
[search index=myCompIn source="/locatedin/mySrc.log" RT_DCC_TYPE=converted | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false true false)"] | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false false true)"] | timechart span=1d count AS bTXN]
Try this
index=myCompIn source="/locatedin/mySrc.log" ("Reply Back" "CAT-IN " "SOME STUFF") OR ("CAT-IN | 91.8.1952.7.4 | (false true false)" ) OR ("CAT-IN | 91.8.1952.7.4 | (false false true)") OR ( RT_DCC_TYPE=converted ) OR ( "CAT-IN | 91.8.1952.7.4 | (false true false)") OR ( "CAT-IN | 91.8.1952.7.4 | (false false true)" )
| eval catin=case(searchmatch("CAT-IN | 91.8.1952.7.4 | (false true false)",1,searchmatch("CAT-IN | 91.8.1952.7.4 | (false false true)",1,true(),0)
| eval aTXN=if(searchmatch("\"Reply Back\" \"CAT-IN \" \"SOME STUFF\""),1,0) + catin
| eval bTXN=if(searchmatch("RT_DCC_TYPE=converted"),1,0) + catin
| timechart span=1d sum(aTXN) as aTXN sum(bTXN) as bTXN
Try this
index=myCompIn source="/locatedin/mySrc.log" ("Reply Back" "CAT-IN " "SOME STUFF") OR ("CAT-IN | 91.8.1952.7.4 | (false true false)" ) OR ("CAT-IN | 91.8.1952.7.4 | (false false true)") OR ( RT_DCC_TYPE=converted ) OR ( "CAT-IN | 91.8.1952.7.4 | (false true false)") OR ( "CAT-IN | 91.8.1952.7.4 | (false false true)" )
| eval catin=case(searchmatch("CAT-IN | 91.8.1952.7.4 | (false true false)",1,searchmatch("CAT-IN | 91.8.1952.7.4 | (false false true)",1,true(),0)
| eval aTXN=if(searchmatch("\"Reply Back\" \"CAT-IN \" \"SOME STUFF\""),1,0) + catin
| eval bTXN=if(searchmatch("RT_DCC_TYPE=converted"),1,0) + catin
| timechart span=1d sum(aTXN) as aTXN sum(bTXN) as bTXN
This worked exactly. Tanx very much.
Try this
*UPDATED*
index=myCompIn source="/locatedin/mySrc.log" "Reply Back" "CAT-IN | 91.8.1952.7.4" | timechart span=1d count(eval(match(_raw, "SOME STUFF")) as A count(eval(RT_DCC_TYPE="converted")) as B
Thanks for this sundareshr but no luck with it, I get the following error "Error in 'timechart' command: Repeated group-by field '_time'."
Try the updated answer.
Tanx. Still the same error code produced.
🙂 try this time
Tanx. This runs without error but does not find any results!
Do you get any data back when you remove the last segment (timechart)?