Create dashboard breaking down to partner sites

Comments

2 comments

  • Avatar
    Don Gothing

    Hi Daniel,

     

    To parse reasonCode and AttributeAgentID I would use these statements:

    | parse "\'ReasonCode\' \'*\'" as reasonCode
    | parse "AttributeAgentID \'*\'" as agentID

    Then show only reasonCodes equal to "Phone Issue":

    | where reasonCode="Phone Issue"

    And aggregate by agentID:

    | count by agentID

    Then on the aggregate results tab you can select a graph of the results from the upper bar and add that to a dashboard with the "Add to Dashboard" button.

    0
    Comment actions Permalink
  • Avatar
    Don Gothing

    For regular searches and dashboards the best practice is to add a field extraction rule to parse the fields on ingest rather than in the query to keep the query running quickly. Here's a link to the documentation on field extraction rules.

    0
    Comment actions Permalink

Please sign in to leave a comment.