Hi, It won't let me update the question, so I'll add the current state of my query here.
I'm trying to get all of the columns from my appended table (which has every column and none of the columns are blank)
search index=rtm3_eapi_summary "mortgages" OR "home-equity-loans" OR "home-loans" OR "serviceable-instances" earliest=-1mon@mon latest=@mon [search index=rtm3_eapi_summary earliest=-1d@d latest=@d "/loans/home-loans/accounts" | fields date_mday ] | eval total_call_count=total_call_count/3 | lookup hl_servicing_dispostion_lookup Service as SERVICE OUTPUT Disposition as disposition| stats count as CurrentVolume count(eval(Status="0")) as Cur_Success count(eval(Status!="0")) as Cur_Failure count(eval(Status!="0" AND disposition=="POLICY")) as Policy_Failure avg(avg_Response_Time) as ResponseTime avg(total_call_count) as count sum(total_call_count) as ThreeMonAverageVolume by SERVICE date_mday HTTPMETHOD CLIENT
into the full table.
index=rtm RelativeURI "mortgages" OR "home-equity-loans" OR "home-loans" OR "serviceable-instances" NOT "/applications*" NOT "/applicants*" NOT "/qualification*" NOT "/loan-solutions*" NOT "/decision*" NOT "/closing-costs*" NOT Client="enterpriseapi-5jLUHRmf9X59QNmgxWucnr54" NOT "SBBCREDITPATH"
| eval CLIENT=if(match(CorrelationID,"ALX-ECO*"),"Alexa",CLIENT)
| lookup hl_servicing_dispostion_lookup Service as SERVICE OUTPUT Disposition as disposition
| stats count as CurrentVolume count(eval(Status="0")) as Cur_Success count(eval(Status!="0")) as Cur_Failure count(eval(Status!="0" AND disposition=="POLICY")) as Policy_Failure avg(ResponseTime) as ResponseTime avg(total_call_count) as count by SERVICE date_mday HTTPMETHOD CLIENT Version
| eval SuccessPercent = (Cur_Success /(Cur_Success + Cur_Failure ))*100
| eval AbsoluteSuccessPercent = (Cur_Failure-Policy_Failure)/(if(Cur_Failure==0,1,Cur_Failure))*100
| eval SuccessPercent=round(SuccessPercent,2)
| eval AbsoluteSuccessPercent = round(AbsoluteSuccessPercent,2)
| eval ResponseTime = round(ResponseTime,1)
| eval ThreeMonAverageVolume=round(ThreeMonAverageVolume)
| append
[search index=rtm3_eapi_summary "mortgages" OR "home-equity-loans" OR "home-loans" OR "serviceable-instances" earliest=-1mon@mon latest=@mon [search index=rtm3_eapi_summary earliest=-1d@d latest=@d "/loans/home-loans/accounts" | fields date_mday ] | eval total_call_count=total_call_count/3 | lookup hl_servicing_dispostion_lookup Service as SERVICE OUTPUT Disposition as disposition| stats count as CurrentVolume count(eval(Status="0")) as Cur_Success count(eval(Status!="0")) as Cur_Failure count(eval(Status!="0" AND disposition=="POLICY")) as Policy_Failure avg(avg_Response_Time) as ResponseTime avg(total_call_count) as count sum(total_call_count) as ThreeMonAverageVolume by SERVICE date_mday HTTPMETHOD CLIENT]
| eval AVGmilliseconds=round(ResponseTime)
| eval ThreeMonAverageVolume=round(ThreeMonAverageVolume)
| eval VolPercentChange = round((CurrentVolume - ThreeMonAverageVolume) / ThreeMonAverageVolume * 100)
| table CLIENT SERVICE CurrentVolume SuccessPercent SuccessPercent Policy_Failure AbsoluteSuccessPercent AVGmilliseconds HTTPMETHOD date_mday Version count ThreeMonAverageVolume VolPercentChange
| sort by SuccessPercent +, CurrentVolume +
The columns that come out of the sub search are:
SERVICE,date_mday, HTTPMETHOD,CLIENT, CurrentVolume, Cur_Success, Cur_Failure, Policy_Failure, ResponseTime, count, ThreeMonthAverageVolume
And there are no empty columns
The columns yeilded from the whole query are:
CLIENT SERVICE CurrentVolume SuccessPercent Policy_Failure AbsoluteSuccessPercent AVGmilliseconds HTTPMETHOD date_mday Version count ThreeMonthAverageVolume VolPercentChange
Where all of the yielded columns are fine, but "count," "ThreeMonthAverageVolume" and "VolPercentChange" are all empty columns.
I thought append would merge the two datasets columns, by "SERVICE," "date_mday," "HTTPMETHOD," and "CLIENT," but that doesn't seem to be the case.
... View more