Thanks for your reply.  I have this error message :  Error in 'delete' command: You have insufficient privileges to delete events. How can I do please ?  Thanks in advance ... View more

Hello @gcusello and @isoutamo  Thank you very for your help and explanation, its working 🙂  I have other question, i have this extraction :  ref               action            prices 1674822  sales                0 1674822  purchases    200 3062981  purchases    0 3062981  sales               0 in this case, I dont want purchases with prices = 0.  If action=purchase prices=0 => the ref not display i want have just this :  ref               action            prices 1674822  sales                0 1674822  purchases    200 As the ref 3062981 has purchase with price=0, it doesn't display.  can you help me on the command to use please ? documentation ?  Thanks in advance.   ... View more

Giuseppe,  Thanks for the advice "od double = and parenthesys" 🙂 but The commande doesn't display what i want :  index=main sourcetype="*" action=purchase OR action=sales | eval prices=if(action="purchase" AND prices="200", "ok", prices) | where prices = "ok" | table action prices The result only displays purchase with prices = 200 but no sales. so I think i have a condition pour sales for example : index=main sourcetype="*" action=purchase OR action=sales | eval prices=if(action="purchase" AND prices="200", "ok", prices) | eval prices=if(action="sales" AND prices=*, "ok", prices) | where status = "ok" | table action prices type If it's not possible, i wiil do two extraction (one for purchases and other for sales). Thanks in avance. ... View more

Hello Giuseppe, I know this command but i wanted display in my table, i have purchases (just prices=200) and sales (all prices). For example this result :  action prices date  purchase 200 28072020  sales 50  05062020  sales 200 10092019  purchase 200 12102019 .....  i will add type purchases and sales for my extraction (action prices date type)  Thanks in advance for your help.  ... View more

Hello Giuseppe, Thank you very much for your answer and your help. I tried this command :  index=main sourcetype="*" action=purchase OR action=sales | eval prices=if((action=="purchase") AND (prices=="200"), "ok", prices) | where prices = "ok" | table action prices but it doesn't work 😞  result : purchase ok  whereas i want too have sales for example :  purchase 200  sales          300  sales            50  ...... Thanks in advance ... View more

Thank you very much for your help and your explanation. ... View more

Hello richgalloway, thanks for your answer. if i remove 350 in the where clause, i will have this : 128 261313851 screen 307 538601320 aquarium but this 261313851 invoice is not correct for me because it's contains too id = 350 so i want just : 307 538601320 aquarium ....... How can i do please ? Thank you very much for your help and your advice. ... View more