I have two fields body.response.failedItemsCount , body.failedItemsCount , In this I have to filter with two unwanted fields :
"body.response.failedItemsHistory{}.itemName"!="Item Not Recognized" AND "body.response.failedItemsHistory{}.itemName"!="Loading..."
""body.failedItemsHistory{}.itemName"!="Item Not Recognized" AND "body.failedItemsHistory{}.itemName"!="Loading..."
I tried base search:
| spath "body.response.failedItemsHistory{}.itemName" | search "body.response.failedItemsHistory{}.itemName"!="Item Not Recognized" AND "body.response.failedItemsHistory{}.itemName"!="Loading..." OR "body.failedItemsHistory{}.itemName"!="Item Not Recognized" AND "body.failedItemsHistory{}.itemName"!="Loading..." | stats sum(body.response.failedItemsCount) as sum1 , sum("body.failedItemsCount") as sum2 | eval totalsum = sum1 + sum2
How can I get sum of total sum of failed items count after excluding Item Not Recognized and Loading for both fields?
Hi @monipinni
Try with
yourquery...| search "body.response.failedItemsHistory.itemName"!="Item Not Recognized" AND "body.response.failedItemsHistory.itemName"!="Loading..." OR "body.failedItemsHistory.itemName"!="Item Not Recognized" AND "body.failedItemsHistory.itemName"!="Loading..."
Hi @monipinni
Try with
yourquery...| search "body.response.failedItemsHistory.itemName"!="Item Not Recognized" AND "body.response.failedItemsHistory.itemName"!="Loading..." OR "body.failedItemsHistory.itemName"!="Item Not Recognized" AND "body.failedItemsHistory.itemName"!="Loading..."