@ITWhisperer - Refer the below comments inline: Are there lines where "AP sent to" or "AH sent to" or "MP sent to" exist in events without "---> TRN:" also being presents? -- No. "AP sent to" or "AH sent to" or "MP sent to" events always exist with "---> TRN:" Similarly, are there events where "---> TRN:" exists and one of "AP sent to" or "AH sent to" or "MP sent to" does not exists? -- No. "---> TRN:" events always exist with "AP sent to" or "AH sent to" or "MP sent to" Please can you explain the significance of the dropdown and how it determines which events are counted? > This dropdown is to make the Dashboard looks simpler. That is based on the Priority of Low, Medium or High will show the Transaction Pending volume.  Or in case, if you have other idea to handle the same - kindly suggest the same. ... View more

Thank you for your kind response @ITWhisperer I have made the correction in the 2nd query: "<===" was referring from a different log event. Updated query:  source=/applications/test/*instance_xyz* ("<--- TRN:" OR "---> TRN:" OR "AP sent to" OR "AH sent to" OR "MP sent to") Refer below inline response to your question: The main issue with your request is that you haven't explained how the events are to be correlated between the two sources and how you would like to count them to give the desired result. Answer: There are basically 2 log files. "testget.log" using search criteria as "<--- TRN:" and Priority field information. "testput.log" using search criteria as "---> TRN:" OR "AP sent to" OR "AH sent to" OR "MP sent to" I need help to co-relate these 2 logs based on TRN. And final count I need to get it using TRN and TestMQ. Select: Low, Medium, High (From the Dashboard dropdown) Output Expected: TestMQ| Low-Testget | Low-Testput | Low-AP | Low-AH | Low-MP | Low-Pending TestMQ | Medium-Testget | Medium-Testput | Medium-AP | Medium-AH | Medium-MP | Medium-Pending TestMQ | High-Testget | High-Testput | High-AP | High-AH | High-MP | High-Pending Please suggest. ... View more

@dtburrows3 @gcusello @PickleRick @ITWhisperer - Kindly help ... View more

Sample "testput.log" file as below: 240418 06:44:53 3543 testput1: ---> TRN: 133c0119a15e407595cd46c89216ca101 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:53 3543 testput1: <=== TRN@Al10: 133c0119a15e407595cd46c89216ca101 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:44:52 3543 testput1: ---> TRN: b247073ae24443d79be3360de4c1bfec1 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:52 3543 testput1: <=== TRN@Al5: b247073ae24443d79be3360de4c1bfec1 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:44:52 3543 testput1: ---> TRN: f3cf7266d2ad4fa6bf86412441c374991 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:52 3543 testput1: <=== TRN@Al10: f3cf7266d2ad4fa6bf86412441c374991 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:44:52 3543 testput1: ---> TRN: d7de4351d94040a995eb373fe834a0371 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:52 3543 testput1: <=== TRN@Al13: d7de4351d94040a995eb373fe834a0371 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:44:50 3543 testput1: ---> TRN: c36d67d7af5f45f28afe0af2a80c6ea61 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:50 3543 testput1: <=== TRN@Al9: c36d67d7af5f45f28afe0af2a80c6ea61 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:43:31 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800194GN00002-DREn00001A> . Out Status = < > 240418 06:43:31 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800194GN00002-DREn00001A> . In Status = <P> 240418 06:43:31 3543 testput1: ---> TRN: UVW024041800194GN00002-DREn00001A - MP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:43:31 3543 testput1: <=== TRN@mmicntl: UVW024041800194GN00002-DREn00001A - MP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:41:25 3543 testput1: ---> TRN: fbccac1e49bf41b9a66ac87c2e9976691 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:41:25 3543 testput1: <=== TRN@Al9: fbccac1e49bf41b9a66ac87c2e9976691 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:59 3543 testput1: ---> TRN: UVW024041800194GN00013 - MP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:59 3543 testput1: SendResponseToHost : Sending response to the Host 240418 06:39:59 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800194GN00013-DREn0000cA> . Out Status = <P> 240418 06:39:59 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800194GN00013-DREn0000cA> . In Status = <H> 240418 06:39:59 3543 testput1: ---> TRN: UVW024041800194GN00013-DREn0000cA - AH sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:59 3543 testput1: <=== TRN@Al9: UVW024041800194GN00013-DREn0000cA - AH. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:59 3543 testput1: ---> TRN: UVW024041800194GN00007-DREn00006A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:59 3543 testput1: <=== TRN@Al7: UVW024041800194GN00007-DREn00006A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:59 3543 testput1: ---> TRN: UVW024041800194GN00010-DREn00009A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:59 3543 testput1: <=== TRN@Al4: UVW024041800194GN00010-DREn00009A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00008-DREn00007A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al3: UVW024041800194GN00008-DREn00007A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00006-DREn00005A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al1: UVW024041800194GN00006-DREn00005A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00011-DREn0000aA - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al11: UVW024041800194GN00011-DREn0000aA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800194GN00002-DREn00001A> . Out Status = <O> 240418 06:39:58 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800194GN00002-DREn00001A> . In Status = <H> 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00002-DREn00001A - AH sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al10: UVW024041800194GN00002-DREn00001A - AH. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00012-DREn0000bA - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al8: UVW024041800194GN00012-DREn0000bA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00003-DREn00002A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al14: UVW024041800194GN00003-DREn00002A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00001 - MP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: SendResponseToHost : Sending response to the Host 240418 06:39:58 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800194GN00001-DREn00000A> . Out Status = <P> 240418 06:39:58 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800194GN00001-DREn00000A> . In Status = <H> 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00001-DREn00000A - AH sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al13: UVW024041800194GN00001-DREn00000A - AH. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:46 3543 testput1: <=== TRN@Al8: 34e4c77406e647d29859a7c3e0077cab1 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:46 3543 testput1: ---> TRN: 34e4c77406e647d29859a7c3e0077cab1 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:37:40 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <MNCDBC2024041804991213-DREg0000aA> . Out Status = < > 240418 06:37:40 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <MNCDBC2024041804991213-DREg0000aA> . In Status = <P> 240418 06:37:40 3543 testput1: ---> TRN: MNCDBC2024041804991213-DREg0000aA - MP sent to [TEST.SND.TO.CPC@QM.PQRS103]. 240418 06:37:40 3543 testput1: <=== TRN@mmicntl: MNCDBC2024041804991213-DREg0000aA - MP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:28 3543 testput1: ---> TRN: 17bd221de8f14fd09439fc2bb9564bed1 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:37:28 3543 testput1: <=== TRN@Al9: 17bd221de8f14fd09439fc2bb9564bed1 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:23 3543 testput1: <=== TRN@mmicntl: CLG024041800098GN00001-DREh00023A - MP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:23 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <CLG024041800098GN00001-DREh00023A> . Out Status = < > 240418 06:37:23 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <CLG024041800098GN00001-DREh00023A> . In Status = <P> 240418 06:37:23 3543 testput1: ---> TRN: CLG024041800098GN00001-DREh00023A - MP sent to [TEST.SND.TO.CLH@QM.PQRS103]. 240418 06:37:17 3543 testput1: ---> TRN: MNO24041800065GS00077-DREl0004cA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:17 3543 testput1: <=== TRN@Al2: MNO24041800065GS00077-DREl0004cA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:17 3543 testput1: ---> TRN: MNO24041800065GS00079-DREl0004eA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:17 3543 testput1: <=== TRN@Al5: MNO24041800065GS00079-DREl0004eA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:16 3543 testput1: ---> TRN: MNO24041800065GS00081-DREl00050A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:16 3543 testput1: <=== TRN@Al1: MNO24041800065GS00081-DREl00050A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:16 3543 testput1: ---> TRN: MNO24041800065GS00075-DREl0004aA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al1: MNO24041800065GS00064-DREl0003fA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:15 3543 testput1: ---> TRN: MNO24041800065GS00063-DREl0003eA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al13: MNO24041800065GS00063-DREl0003eA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:15 3543 testput1: ---> TRN: MNO24041800065GS00066-DREl00041A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al3: MNO24041800065GS00066-DREl00041A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:15 3543 testput1: ---> TRN: MNO24041800065GS00058-DREl00039A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al2: MNO24041800065GS00058-DREl00039A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:15 3543 testput1: ---> TRN: MNO24041800065GS00061-DREl0003cA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al12: MNO24041800065GS00061-DREl0003cA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: <=== TRN@Al4: MNO24041800065GS00035-DREl00022A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00033-DREl00020A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:12 3543 testput1: <=== TRN@Al5: MNO24041800065GS00033-DREl00020A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00039-DREl00026A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:12 3543 testput1: <=== TRN@Al3: MNO24041800065GS00039-DREl00026A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00044-DREl0002bA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:12 3543 testput1: <=== TRN@Al14: MNO24041800065GS00044-DREl0002bA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00038-DREl00025A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:12 3543 testput1: <=== TRN@Al1: MNO24041800065GS00038-DREl00025A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00036-DREl00023A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al9: MNO24041800065GS00026-DREl00019A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00019-DREl00012A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al1: MNO24041800065GS00019-DREl00012A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00025-DREl00018A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al5: MNO24041800065GS00025-DREl00018A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00016-DREl0000fA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al4: MNO24041800065GS00016-DREl0000fA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: vlog: Current log size is 3497994 bytes 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00024-DREl00017A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al3: MNO24041800065GS00024-DREl00017A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00017-DREl00010A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al12: MNO24041800065GS00017-DREl00010A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00022-DREl00015A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al13: MNO24041800065GS00022-DREl00015A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00023 - MP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: SendResponseToHost : Sending response to the Host 240418 06:37:11 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <MNO24041800065GS00023-DREl00016A> . Out Status = <P> 240418 06:37:11 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <MNO24041800065GS00023-DREl00016A> . In Status = <H> 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00023-DREl00016A - AH sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al10: MNO24041800065GS00023-DREl00016A - AH. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:09 3543 testput1: ---> TRN: MNO24041800065GS00007-DREl00006A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:09 3543 testput1: <=== TRN@Al14: MNO24041800065GS00007-DREl00006A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:09 3543 testput1: ---> TRN: MNO24041800065GS00004-DREl00003A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:09 3543 testput1: <=== TRN@Al8: MNO24041800065GS00004-DREl00003A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:09 3543 testput1: ---> TRN: MNO24041800065GS00001-DREl00000A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:35:10 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800193GN00003-DREh0002dA> . Out Status = < > 240418 06:35:10 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800193GN00003-DREh0002dA> . In Status = <P> 240418 06:35:10 3543 testput1: ---> TRN: UVW024041800193GN00003-DREh0002dA - MP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:35:10 3543 testput1: <=== TRN@mmicntl: UVW024041800193GN00003-DREh0002dA - MP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1.   ... View more

Refer below sample log file - there are 2 log files "testget.log" & "testput.log" Sample "testget.log" file as below: 240418 06:44:51 37787 testget1: ===> TRN@instance_abc.RQ1: 133c0119a15e407595cd46c89216ca101 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:51 37787 testget1: <--- TRN: 133c0119a15e407595cd46c89216ca101 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:51 37787 testget1: ===> TRN@instance_abc.RQ1: b247073ae24443d79be3360de4c1bfec1 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:51 37787 testget1: ===> TRN@instance_abc.RQ1: f3cf7266d2ad4fa6bf86412441c374991 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:51 37787 testget1: <--- TRN: b247073ae24443d79be3360de4c1bfec1 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:51 37787 testget1: <--- TRN: f3cf7266d2ad4fa6bf86412441c374991 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:51 37787 testget1: ===> TRN@instance_abc.RQ1: d7de4351d94040a995eb373fe834a0371 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:50 37787 testget1: <--- TRN: d7de4351d94040a995eb373fe834a0371 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:49 37787 testget1: ===> TRN@instance_abc.RQ1: c36d67d7af5f45f28afe0af2a80c6ea61 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:49 37787 testget1: <--- TRN: c36d67d7af5f45f28afe0af2a80c6ea61 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:41:24 37787 testget1: ===> TRN@instance_abc.RQ1: fbccac1e49bf41b9a66ac87c2e9976691 [Priority=Medium,ScanPriority=4, Rule: LOC=HK2; Cur=USD; Amt≥0; Srv=ALL; Recv@1565936557:00 00-00-0000]. 240418 06:41:24 37787 testget1: <--- TRN: fbccac1e49bf41b9a66ac87c2e9976691 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00013-DREn0000cA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00012-DREn0000bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00011-DREn0000aA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00010-DREn00009A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00009-DREn00008A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00008-DREn00007A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00007-DREn00006A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00006-DREn00005A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00005-DREn00004A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00004-DREn00003A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00003-DREn00002A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00002-DREn00001A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00013-DREn0000cA - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00012-DREn0000bA - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00011-DREn0000aA - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00010-DREn00009A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00009-DREn00008A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00008-DREn00007A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00007-DREn00006A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: vlog: Current log size is 2441342 bytes 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00006-DREn00005A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00005-DREn00004A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00004-DREn00003A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00003-DREn00002A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00002-DREn00001A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:56 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00001-DREn00000A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:56 37787 testget1: <--- TRN: UVW024041800194GN00001-DREn00000A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:37:45 37787 testget1: ===> TRN@instance_abc.RQ1: 34e4c77406e647d29859a7c3e0077cab1 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:45 37787 testget1: <--- TRN: 34e4c77406e647d29859a7c3e0077cab1 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:37:28 37787 testget1: ===> TRN@instance_abc.RQ1: 17bd221de8f14fd09439fc2bb9564bed1 [Priority=Medium,ScanPriority=4, Rule: LOC=HK2; Cur=USD; Amt≥0; Srv=ALL; Recv@1565936557:00 00-00-0000]. 240418 06:37:28 37787 testget1: <--- TRN: 17bd221de8f14fd09439fc2bb9564bed1 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00081-DREl00050A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00080-DREl0004fA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00079-DREl0004eA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00078-DREl0004dA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00077-DREl0004cA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00076-DREl0004bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00059-DREl0003aA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00058-DREl00039A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00057-DREl00038A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00056-DREl00037A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00055-DREl00036A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00054-DREl00035A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00053-DREl00034A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00052-DREl00033A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00081-DREl00050A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00080-DREl0004fA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00079-DREl0004eA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00078-DREl0004dA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00077-DREl0004cA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00076-DREl0004bA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00071-DREl00046A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00057-DREl00038A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00056-DREl00037A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00055-DREl00036A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00054-DREl00035A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00053-DREl00034A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00052-DREl00033A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00051-DREl00032A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00050-DREl00031A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00049-DREl00030A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00048-DREl0002fA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00047-DREl0002eA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00031-DREl0001eA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00030-DREl0001dA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00029-DREl0001cA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00028-DREl0001bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00027-DREl0001aA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00026-DREl00019A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00025-DREl00018A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00024-DREl00017A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: vlog: Current log size is 2427949 bytes 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00023-DREl00016A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00022-DREl00015A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00021-DREl00014A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00020-DREl00013A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00009-DREl00008A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00008-DREl00007A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00007-DREl00006A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00006-DREl00005A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00005-DREl00004A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00004-DREl00003A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00003-DREl00002A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00002-DREl00001A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00051-DREl00032A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00050-DREl00031A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00049-DREl00030A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00048-DREl0002fA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00047-DREl0002eA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00046-DREl0002dA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00045-DREl0002cA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00044-DREl0002bA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00043-DREl0002aA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00042-DREl00029A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00036-DREl00023A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00035-DREl00022A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:07 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00001-DREl00000A [Priority=Low,ScanPriority=0, Rule: Default Rule].         ... View more

Hi @gcusello  I have added below more lines of the sample event file - please help me find the right key. Or if not possible with the correlation Key - how to proceed with the JOIN in this case? Kindly guide and suggest.   240108 07:12:07 17709 testget1: ===> TRN@instance2.RQ1: 0000002400840162931785-AHGM0000bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240108 07:12:07 17709 testget1: <--- TRN: 0000002400840162929525-AHGM00015A - S from [RCV.FROM.TEST.SEP2.Q2@QM.ABCD101].     ... View more

Hi @gcusello - Thank you for you continuos support. I am able to proceed next with your suggestion but now stuck at one point. Need your help on it.  Kindly suggest. Query Used:  index=test_index source=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | rex field=TestMQ "\w+\.\w+\.(?<key>\w+)" | rex "TRN\@\\w+\.R(?<key>[^:]++):" | rex "Priority\=(?<Priority>\w+)" | stats values(TestMQ) AS TestMQ count(eval(Priority="Low")) as Low, count(eval(Priority="Medium")) as Medium, count(eval(Priority="High")) as High BY key | fillnull value=0 | addtotals Getting results as below: Total count (Q1+Q2) is getting added to Q1 only. And Q2 is remaining null (as shown in below example) key | TestMQ | Low | Medium | High | Total Q1 | TEST.SEP.Q1 | 20 | 20 | 30 | 70 | TEST.SEP2.Q1 | TEST.SEP3.Q1 Q2 | TEST.SEP.Q2 | 0 | 0 | 0 | 0 | TEST.SEP2.Q2 | TEST.SEP3.Q2  Please guide and suggest. ... View more

Hi @gcusello @ITWhisperer  In this case I can see the TransactionID is the common field between both the events (TestMQ and Priority) - but I am unable to find how to use the same in the query. Can you please help and suggest on it? Or can we do a JOIN based transaction id's (for both the event types - TestMQ & Priority)   | rex field=_raw "(?<TransactionID>\d+-\w+)"   ... View more

Hi @gcusello  Refer below requested sample query and event details: Kindly suggest.   index=test_index=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as TotalCount, count(eval(Priority_Level="Low")) as Low, count(eval(Priority_Level="Medium")) as Medium, count(eval(Priority_Level="High")) as High by TestMQ | fillnull value=0     Sample Events:   240105 18:06:03 19287 testget1: ===> TRN@instance.RQ1: 0000002400509150632034-AERG00001A [Priority=Low,ScanPriority=0, Rule: Default Rule]. host = testserver2.com source = /test/test.logsourcetype = testscan 240105 18:06:03 19287 testget1: ===> TRN@instance.RQ1: 0000002400540101635213-AERG00000A [Priority=Low,ScanPriority=0, Rule: Default Rule]. host = testserver2.com source = /test/test.log sourcetype = testscan 240105 18:06:03 19287 testget1: <--- TRN: 0000002481540150632034-AERG00001A - S from [RCV.FROM.TEST.SEP.Q1@QM.ABC123]. host = testserver2.com source = /test/test.log sourcetype = testscan 240105 18:06:03 19287 testget1: <--- TRN: 0000002400547150635213-AERG00000A - S from [RCV.FROM.TEST.SEP.Q1@QM.ABC123]. host = testserver2.com source = /test/test.log sourcetype = testscan 240105 18:02:29 72965 testget1: ===> TRN@instance.RQ1: 0000002400540902427245-AERC000f8A [Priority=Medium,ScanPriority=2, Rule: Default Rule]. host = testserver1.com source = /test/test.log sourcetype = testscan 240105 18:02:29 72965 testget1: ===> TRN@instance.RQ1: 0000001800540152427236-AERC000f7A [Priority=Medium,ScanPriority=2, Rule: Default Rule]. host = testserver1.com source = /test/test.log sourcetype = testscan 240105 18:02:29 72965 testget1: ===> TRN@instance.RQ1: 0000002400540109427216-AERC000f6A [Priority=High,ScanPriority=1, Rule: Default Rule]. host = testserver1.com source = /test/test.log sourcetype = testscan   ... View more

Hello @PickleRick @gcusello @isoutamo - thanks for your kind response. I am reframing my problem statement here: Refer below Sample events from the logs:   240108 07:12:07 17709 testget1: ===> TRN@instance2.RQ1: 0000002400840162931785-AHGM0000bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240108 07:12:07 17709 testget1: <--- TRN: 0000002400840162929525-AHGM00015A - S from [RCV.FROM.TEST.SEP2.Q2@QM.ABCD101].   I am having issues while fetching data from 2 stats (TestMQ and Priority_Level) count fields together. Below is the query:     index=test_index=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as TotalCount, count(eval(Priority_Level="Low")) as Low, count(eval(Priority_Level="Medium")) as Medium, count(eval(Priority_Level="High")) as High by TestMQ | fillnull value=0     This gives me result like example below:     TestMQ | TotalCount | Low | Medium | High MQNam1 | 120 | 0 | 0 | 0 MQNam2 | 152 | 0 | 0 | 0 ..     The problem is that I am getting "0" value for Low, Medium & High columns - which is not correct. I want to combine both the stats and show the group by results of both the fields. If I run the same query with separate stats - it gives individual data correctly. Case 1: stats count as TotalCount by TestMQ     index=test_index=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as TotalCount by TestMQ Example Output: TestMQ | TotalCount MQName | 201       Case 2: stats count as PriorityCount by Priority_Level     index=test_index=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as PriorityCount by Priority_Level Example Output: Priority_Level | PriorityCount High | 20 Medium | 53 Low | 78     Please help and suggest. ... View more

@isoutamo Thanks for your kind response. I tried with the suggested approach. But it doesn't give the expected result. index=Test | rex "(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | chart count BY TestMQ, Priority_Level | fillnull value=0 Getting output as: TestMQ | count Expected output: TestMQ | TotalCount | Low | Medium | High ... View more

Hi @gcusello  Thank you for your kind response. I tried the suggested approach but the result is same. This gives me result like example below: TestMQ    | TotalCount | Low | Medium | High MQNam1 | 120               | 0       | 0               | 0 MQNam2 | 152               | 0       | 0               | 0 The problem is that I am getting "0" value for Low, Medium & High columns - which is not correct. I want to combine both the stats and show the group by results of both the fields. Please suggest. ... View more

Thank you for kind your response @ITWhisperer  I have tried the suggested approach as below: index=<search_string> earliest=-30d@d | timechart span=1m aligntime=earliest count(eval(searchmatch("from"))) as HotCount by TestMQ | where tonumber(strftime(_time, "%H")) >= 2 AND tonumber(strftime(_time, "%H")) < 4 | eval Day=strftime(_time, "%Y-%m-%d") | addtotals fieldname=TotalHotCount label="Total" labelfield=TestMQ It gives me result in below format. It is doing the Row level of Sum.  Additionally I am looking for Merging the column results in Day wise total. (i.e. the total of the given time range should be added as a Day wise output) _time TestMQ1 TestMQ2 TestMQ3 Day TotalHotCount 2023-07-04 02:00:00 100 150 200 2023-07-04 450 2023-07-04 02:01:00 50 100 150 2023-07-04  300 2023-07-04 02:02:00 150 150 300 2023-07-04  600 and so on....for 30 days .. .. .. .. ..   Expected output as below, please suggest what is missing here and how it can be achieved? Kindly suggest. Day Wise TestMQ1 TestMQ2 TestMQ3 TotalHotCount 2023-07-04 120 180 200 500 2023-07-05  90 110 100 300 2023-07-06  150 100 120 370 and so on.... .. .. .. .. ... View more

@ITWhisperer  Thank you for your great help! 🙂 This works fine now. The only modification which I did is below: Removed the below Submit button: <fieldset submitButton="true" autoRun="true"> And enabled searchWhenChanged="true" for below: <input type="dropdown" token="timefrom" searchWhenChanged="false"> <input type="dropdown" token="timeto" searchWhenChanged="false"> ... View more

@ITWhisperer - Thank you for your kind response. Can you please help elaborate more as I could not understand it properly what you are trying to convey here? "best to add to both timeto and timefrom inputs rather than having another timespan input" How do I go about this? ... View more

@ITWhisperer - I tried this suggested approach, but don't see any change in the TimeSpan field. The value is not getting populated in the Text box.  For Example: TimeFrom: 2 TimeTo: 4 TimeSpan = (4 -2)*60 = 120 I am getting below error: "Error in 'timechart' command: The value for option span (nullm) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value." | timechart span=nullm aligntime=earliest count(eval(searchmatch("sent"))) as HotPutCount by HotScanMQ And there is no value getting set into the TimeSpan text box on the dashboard.  Refer below code snippet used: <fieldset submitButton="true" autoRun="true"> <input type="dropdown" token="instance" searchWhenChanged="true"> <label>Instance</label> <choice value="instance1">instance1</choice> <choice value="instance2">instance2</choice> <default>instance1</default> <initialValue>instance1</initialValue> </input> <input type="dropdown" token="timefrom" searchWhenChanged="false"> <label>Time Range From (24 Hour)</label> <choice value="01">01:00</choice> <! code omitted to make it shorted !> <choice value="24">24:00</choice> <default>02</default> <initialValue>02</initialValue> </input> <input type="dropdown" token="timeto" searchWhenChanged="false"> <label>Time Range To (24 Hour)</label> <choice value="01">01:00</choice> <! code omitted to make it shorted !> <choice value="24">24:00</choice> <default>04</default> <initialValue>04</initialValue> </input> <input type="text" token="TimeSpan"> <label>Interval (in mins)</label> <change> <eval token="TimeSpan">($timeto$ - $timefrom$) * 60</eval> </change> </input> </fieldset> ... View more

@ITWhisperer  Your previous suggestion (timechart span=$TimeSpan$m) works fine if the User enters the token value manually. My requirement is to fetch the TimeSpan value dynamically on the basis of Time Range selection by the User. I hope it clarifies now. ... View more

@ITWhisperer  This doesn't solve my problem. (| timechart span=$TimeSpan$m)  I want "timechart span" should be dynamically selected based on the User inputs for the Time Range (i.e. timeto and timefrom).  So given that timeto and timefrom are tokens, I want to set up another token when these tokens are set which equates to the value I want in TimeSpan. TimeSpan = ($timeto$ - $timefrom$) * 60 Note: Additionally, I want to keep TimeSpan field as hidden or disabled for any manual entry by the user. I hope it is clarified now, kindly suggest how this can be achieved? OR the 2nd option: Do we have any way to pass this value as variable/attribute to the "timechart span" in the query itself? I have tried out the below approach, but it doesn't work. | eval TimeSpan= ($timeto$ - $timefrom$) * 60 | timechart span=$TimeSpan$m aligntime=earliest count(eval(searchmatch("sent"))) as HotCount by TestMQ | where tonumber(strftime(_time, "%H")) >= $timefrom$ AND tonumber(strftime(_time, "%H")) <= $timeto$ ... View more

@ITWhisperer - Thank you for your response! I tried the suggested approach, but don't see any change. My Dashboard is having 4 input fields: Instance | Time Range From (24 Hour) | Time Range To (24 Hour) | Interval (in mins) | Submit (button) Interval (in mins) is a Text box. Expected output is the TimeSpan token should write the below calculated value in this field. And it should be disabled for any manual user inputs. For Ex: TimeSpan = 120 Please suggest. Refer below code snippet: <fieldset submitButton="true" autoRun="true"> <input type="dropdown" token="instance" searchWhenChanged="true"> <label>Instance</label> <choice value="instance1">instance1</choice> <choice value="instance2">instance2</choice> <default>instance1</default> <initialValue>instance1</initialValue> </input> <input type="dropdown" token="timefrom" searchWhenChanged="false"> <label>Time Range From (24 Hour)</label> <choice value="01">01:00</choice> <! code omitted to make it shorted !> <choice value="24">24:00</choice> <default>02</default> <initialValue>02</initialValue> </input> <input type="dropdown" token="timeto" searchWhenChanged="false"> <label>Time Range To (24 Hour)</label> <choice value="01">01:00</choice> <! code omitted to make it shorted !> <choice value="24">24:00</choice> <default>04</default> <initialValue>04</initialValue> </input> <input type="text" token="TimeSpan"> <label>Interval (in mins)</label> <change> <eval token="TimeSpan">($timeto$ - $timefrom$) * 60</eval> </change> </input> </fieldset> ... View more

I have tried out multiple options - but kind of stuck here. Please suggest, if there is any different way to achieve the same. Getting error: Invalid child="set" is not allowed in node="conditional-input-change" Kindly suggest. <input type="text" token="TimeSpan" searchWhenChanged="true"> <label>Interval (in mins)</label> <change> <condition>'$timeto$' != '' AND '$timefrom$' != ''</condition> <set token="TimeSpan"=($timeto$ - $timefrom$) * 60</set> </change> </input> @ITWhisperer  @niketn  ... View more

I have tried out below options, but getting error. Please suggest. node <dependency> is not allowed here. node <search> is not allowed here. node <query> is not allowed here. Option 1: <input type="text" token="TimeSpan" searchWhenChanged="true"> <label>Interval (in min)</label> <default></default> <dependency type="value" token="timefrom"> <condition>greater</condition> <value>0</value> </dependency> <dependency type="value" token="timeto"> <condition>greater</condition> <value>0</value> </dependency> <value> <eval token="TimeSpan">("$timeto$" - "$timefrom$") * 60</eval> </value> </input> Option 2: <search id="calculateTimeSpan"> <query> | makeresults | eval TimeSpan = (tonumber('$timeto$') - tonumber('$timefrom$')) * 60 | fields - _time </query> </search> @ITWhisperer  @niketn  ... View more