Create dashboard breaking down to partner sites
-
Hi Daniel,
To parse reasonCode and AttributeAgentID I would use these statements:
| parse "\'ReasonCode\' \'*\'" as reasonCode
| parse "AttributeAgentID \'*\'" as agentIDThen show only reasonCodes equal to "Phone Issue":
| where reasonCode="Phone Issue"
And aggregate by agentID:
| count by agentID
Then on the aggregate results tab you can select a graph of the results from the upper bar and add that to a dashboard with the "Add to Dashboard" button.
-
For regular searches and dashboards the best practice is to add a field extraction rule to parse the fields on ingest rather than in the query to keep the query running quickly. Here's a link to the documentation on field extraction rules.
Please sign in to leave a comment.
Comments
2 comments