Hi,  I am building alert in Splunk. I have a log with 6 different variables, but I am actually interested only in 4 of them (A, B, C and D). Those variables usually have a value which is a number like 50 but it can also be 'unknown' this is a log sample event: {        responseStatus: 200,        calculationBreakdown: {          evaluation: {             A: unknown            B: unknown            C: unknown            D: unknown            E: 50            F: unknown            }       } } I am trying to do the stats for number of 'unknown' values for each variable and total calls; Then I can calculate percentage of 'unknown' for each which is treated as error and then fire my alert based on those stats So I tried simple query: index=someIndex app=someApp event.responseStatus=200  | stats count as total,  sum(eval(if('event.calculationBreakdown.evaluation.A'==unknown, 1, 0))) as total_errors_for_A wanted to do the same for errors for B, C and D, but this does not work at all, it just calculates total for all the requests but 0 for errors_A and I know there are some A =. unknown in the stats so it should be counted;  when I change sum to count it shows the same number in both columns for total and for total_errors_for_A I also tried different quotes for 'event.calculationBreakdown.evaluation.A' and unknown, single / double / no quotes also added spath 'event.calculationBreakdown.evaluation.A' before | stats but that does not change anything Is anyone able to help? I am pretty sure it is something super simple, but my mind goes blank 😞 thanks a million   ... View more

Hi,  I am creating the dashboard, where for couple of panels I will use similar query so I saved shared bit as base query. However I have 2 different indexes (environments) so I also created input to choose appropriate index for the base search. However it looks like it picks up just prod, and not returning results for ppe. Can someone please help me to understand what is wrong with my code?     "dataSources": { "ds_baseSearch": { "type": "ds.search", "options": { "query": "index=\"$env$\" sourcetype=some_sourcetype risk=*\n| spath risk\n| rename risk AS risk\n| eval riskCategory = if(risk <= 1.0, \"low\", if(risk<= 2.0, \"moderate\", \"high\"))\n| stats count(eval(riskCategory==\"low\")) as low, count(eval(riskCategory==\"moderate\")) as moderate, count(eval(riskCategory==\"high\")) as high, count as total\n ", "queryParameters": { "earliest": "$time.earliest$", "latest": "$time.latest$" }, "enableSmartSources": true }, "name": "base_search" }, "ds_search_2": { "type": "ds.chain", "options": { "query": "| stats sum(total) as Total ", "extend": "ds_baseSearch" }, "name": "_total" }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": {} } } } }, "inputs": { "input_2": { "type": "input.timerange", "title": "Time period", "options": { "token": "time", "defaultValue": "-60m@m,now" } }, "input_hw3xXSsR": { "options": { "items": [ { "label": "prod", "value": "_prod" }, { "label": "ppe", "value": "_ppe" } ], "token": "evn", "defaultValue": "_prod" }, "title": "Environment", "type": "input.dropdown", "dataSources": {} } },       ... View more

Hi,  I am trying to show successful validations and failures in one of the dashboard panels. I am logging exceptions in traceData.exception field. In this field there is exception with full stacktrace , but would like to display just exception name so need to extract just first line of exception. My query looks like index=xxx sourcetype="xxx" app=xxx event.data.request.uri="/xxx" | rename event.data.response.statusCode as statusCode | rename event.traceData.exception as exception | rex field=exception "(?<exception>.*)" | eval result = if(statusCode=201,"Valid", 'exception') | timechart span=1h count by result​ the issue is it displays "Valid" calls, but for exceptions it just displays one exception, and the other one is NULL.    _time Valid Token invalid  NULL 2022-10-13 08:00 1 1 1   Both exceptions have the same fields (just different exception values and stacktrace). Could you help me with the query which will display results and extract all the exceptions without stacktrace ? ... View more