index=** sourcetype=**** location=00000
| bin _time span=1d
| rex "\[Id=(?[^\,]*?),[\s ].*?,[\s ]percentage=(?[^\,]*?),[\s ].*?,[\s ]location=(?[^\,]*?),"
max_match=0
| fields *
| stats avg(percentageValue) AS avgpred, stdevp(percentageValue) AS lstdev , var(percentageValue) AS varpf by locationValue,IDValue, _time
| table _time locationValue,IDValue,percentageValue
But I am not able to see the percentageValue and locationValue in table
↧