The current query I have doesn't work. I just added phone_number for the sake of understanding in this thread. In the event below, the phone number is listed as: 15555555555 ... View more

Nm, got it to work. Thanks for your help!! ... View more

Wow, extremely helpful!! I almost got it working. But, for some reason, I can't get the last eval command to show up. Even if I use a table command, it won't show up. I need to create a simple fallback escalation rate as a % for this query.  .... | eval fallbacks=if(match(intent,"fallback"),1,0) | eval agent_escalation=if(match(intent, "support.contact_agent"),1,0) | eval fallback_timestamp=if(fallbacks=1,_time,null()) | eval agent_escalation_timestamp=if(agent_escalation=1,_time,null()) | stats min(fallback_timestamp) as earliest_fallback_timestamp max(agent_escalation_timestamp) as latest_escalation_timestamp max(fallbacks) as had_a_fallback, max(agent_escalation) as had_an_escalation by sessionId | eval time_diff=latest_escalation_timestamp-earliest_fallback_timestamp | eval escalated_after_fallback=if(time_diff>0,1,0) | stats sum(had_a_fallback) as total_fallback_sessions, sum(escalated_after_fallback) as total_escalated_sessions_after_a_fallback sum(agent_escalation) as total_escalated_sessions | eval Fallback_escalation_rate=round(total_fallback_sessions/total_escalated_sessions*100, 1)   ... View more

I like where you're headed! But it's missing the sequence of events. The "escalation rate" is if the session contains any instance of followup_live_agent.  The fallback escalation rate is if a followup_live_agent intent exists AFTER the fallback intent. This is the one I can't seem to figure out.  ... View more

Thank you!! This is exactly what I was looking for.  ... View more

Thanks for the reply! Interesting solution. Do you have an example using the query I posted above? I'm not sure I know how to put this into practice. Also, in my situation, there's only 3 events, so it should work.  ... View more

Yes, this seems like it would be exactly what I'm looking for, but it's only displaying one line. I can't get it to show the "Less than 2 intents" line.  I only see the counts for "Total Sessions with More than 2 Intents." I think the "| where intent_count >= 5" line is filtering results for the entire query, which is why it's not showing counts for less than 5.  Could a "bin" command work instead?  ... View more

Thank you! This is very helpful.  How do I group these into 2 buckets? First bucket is sessions with 0-1 intent_count, and second bucket is => 2 intent_count.  ... View more

I listed 2 sample events below. This is query for a chatbot platform. A conversation between a user and the bot is referred to as a session. A user can hit multiple intents in a session. I'm trying to group sessions with 0 or 1 intents, and sessions with 2 or more intents.  My original query was just a poor attempt to get to this data.  2022-06-03T19:25:53,135+0000 [INFO ] level=INFO [RxCachedThreadScheduler-10]-[sessionId=0d326922-5526-4ca9-bdf8-c74b9bf665c8 test=false botId=ccb offl_TKT=false proto=V2 platform=WEB input_type=TEXT sku= pn= cid=3fd323ae-5958-4538-8e92-15567ad6d39e convo=]-[FulfillmentServiceImpl]-[381 ] Processing intent: intent=payroll.help_preferences_standard conversation=payroll.help_preferences_standard index = conversationintent = payroll.help_preferences_standardlinecount = 1punct = --::,+_[_]_=__[-]-[=----_=_=----_=_=----_=----_=_=sessionId = 0d326922-5526-4ca9-bdf8-c74b9bf665c8splunk_server 6/3/22 12:25:53.133 PM 2022-06-03T19:25:53,133+0000 [INFO ] level=INFO [RxCachedThreadScheduler-10]-[sessionId=0d326922-5526-4ca9-bdf8-c74b9bf665c8 test=false botId=ccb offl_TKT=false proto=V2 platform=WEB input_type=TEXT convo=]-[AnalyticsServiceImpl]-[129 ] cuidata=true type=user intent=payroll.update_account confidence=1.0 feedback=false handled=true message="Configurer la paie"; index = conversationintent = payroll.update_account = 1punct = --::,+_[_]_=__[-]-[=----_=_=----_=_=----_=----_=_=sessionId = 0d326922-5526-4ca9-bdf8-c74b9bf665c8   ... View more

For some reason, the case number field doesn't show up unless I add in "case_number=*' Dually noted your eval command. I'm sure I'll end up using it if I can figure out how to get the blank case number values to populate.  ... View more

This is really good to know! But, I still wasn't able to get events without a case number to show up.  I think the case_number=* parameter is enforcing that a value is present for this field.  ... View more

This query seems like it's the best version so far. The product name shows as the first phrase in every line in the table, but the rest of the event is showing after the product name. I think I need to specific a word count or something. | eval account_lookup__product_name = product_name | rex "product_name=(?<product_name>.*)" | table product_name Here's one line from the table: Cash product account_lookup__product_name__product_score=0.4215 account_lookup__product_name__score_success=true account_lookup__product_name__success=true   ... View more

I'm still having some trouble.  Here's my current query.  | rename account_lookup__product_name as product | table product | rex "product=(?<product>.*)"  I've tried moving the rex command before the table, but then the entire event log shows in the table. I also tried doing this without the rename parameter, but it said the rex name is too long. (The actual field name is much longer than what I'm showing here - I omitted some words for security purposes.) Regex: subpattern name is too long (maximum 32 characters).   ... View more

This is a typical event.      account_lookup__level=|||| account_lookup__has_contacts_id=true account_lookup__premium=false account_lookup__intent_pred=buy_product account_lookup__intent_pred_score=0.66920596 account_lookup__intent_pred_utterance=buy a product account_lookup__is_accountant=false account_lookup__product_family=PAYMENTS account_lookup__product_name=Cash product account_lookup__score_success=true account_lookup__success=true      And here's my table query     | table account_lookup__product_name _time     Which shows as      Cash | 2022-05-09 14:23:29     ... View more