How to get latest transactionId ?

[karthi2809]

Hi All,

I am trying to get count of enabled and disabled from field. Then i want to show the field values based on latest correlation ID.The currstatus field will run for every 10 min.

"content.currStatus"="*" |stats  values(content.currStatus) as currStatus by latest(correlationId)|where currStatus!="Interface has no entry found in object Store"|stats count by currStatus

[gcusello]

Hi @karthi2809 ,

if currStatus has values enabled or disabled, please try something like this:

"content.currStatus"="*" content.currStatus!="Interface has no entry found in object Store"
| rename content.currStatus AS currStatus
| stats  
     count(eval(currStatus="enabled"))AS enabled_count
     count(eval(currStatus="disabled"))AS disabled_count
     last(currStatus) AS last_currStatus
     BY correlationId)

In addition one hint: add always the index containing these events: you'll have a faster search and you'll be sure to take events.

Ciao.

Giuseppe

[karthi2809]

Just i want to show the latest correlationId and in your query its showing multiple correlationID and i just want show the count of enabled and disabled in pie chart.

[ITWhisperer]

Try something like this

"content.currStatus"="*" [search <your index> | stats latest(correlationId) as correlationId | table correlationId | format] | where currStatus!="Interface has no entry found in object Store"|stats count by currStatus

[karthi2809]

Hi @ITWhisperer 

The query which is working but i need total counts of enabled and disabled in the output .Now its showing  1 for enabled and 1for disabled.But the event is getting 79 

index="mulesoft" applicationName="scheduler"    message="Upcoming :*" [search index="mulesoft" applicationName="scheduler"  | stats latest(correlationId) as correlationId | table correlationId | format]  |stats   values(content.currStatus) as currStatus by correlationId|where currStatus!="Interface has no entry found in object Store"|stats count by currStatus

There are 79 events in this 74 is enabled and 5 are disabled .The values enabled and disabled from currstatus field.

[ITWhisperer · Accepted solution]

You don't need the stats values() line

index="mulesoft" applicationName="scheduler"    message="Upcoming :*" [search index="mulesoft" applicationName="scheduler"  | stats latest(correlationId) as correlationId | table correlationId | format]  |where `content.currStatus`!="Interface has no entry found in object Store"|stats count by `content.currStatus`

[karthi2809]

Got it thanks its working and latest correlationId .What time frequency the correlationId change.

[ITWhisperer]

Apart from you, who else knows how frequently the correlation id changes?

[karthi2809]

Sorry its not working .Sometimes the values coming but sometimes its not showing any values

.

[ITWhisperer]

Please provide examples of what is working and what is not working otherwise just saying it is not working is not very helpful!

[karthi2809]

Hi @ITWhisperer 
First time its coming when i am trying to refresh the same query i am not find any values

Query which i am trying:

index="mulesoft" applicationName="scheduler" environment=DEV   message="Upcoming Executions for Scheduler :*"  [search index="mulesoft" applicationName="
scheduler"  | stats latest(correlationId) as correlationId | table correlationId | format] |where content.currStatus!="Interface has no entry found in object Store"|stats count by content.currStatus

If i use the query in seperate search its showing the latest correlation values:
message="Upcoming Executions for Scheduler :*"  environment=DEV | stats  latest(correlationId) as correlationId   | table correlationId

[karthi2809]

If i remove stats line it will shows 0 events.Not showing any counts