I have a dashboard that displays 3 radials. I want to display the average of the numeric result of those three radials also on the dashboard. I can create references to those radials and refer to their results something like ($ds_1:result.avg$ + $ds_3:result.avg$ + $ds_3:result.avg$) / 3 but I don't know how to create SPL to do just that vs looking up logs. For example, I tried      | eval avg=($ds_1:result.avg$ + $ds_3:result.avg$ + $ds_3:result.avg$) / 3 | table avg     this didn't work. For context, each of those referred datasources outputs avg(field) as avg.  How can I achieve what I'm after? ... View more

My query: index=primary eventType=ConnectionTest msg="network check results" | spath output=connectError details.error.connectionError | fillnull value=false connectError | dedup visitId | stats count as total, count(eval(connectError==true)) as errors If I run this, "errors" always returns 0. However, if I run index=primary eventType=ConnectionTest msg="network check results" | spath output=connectError details.error.connectionError | fillnull value=false connectError | dedup visitId | stats count by connectError connectError properly returns the set of values in each bucket of connectError. My dataset will sometimes contain the object "details.error". I tried fillnull to resolve this but that didn't work. If I look at the Events data for the first or second query, I do see "connectError" in the "Interesting Fields" list on the left hand side. ❓How do I get the first query to work whereby I can get errors and total errors? I want to follow it up with |eval percentErrors=errors/total but I first need to get the stats to work properly. ... View more