Merge branch 'develop' of https://github.com/nhsconnect/gpconnect-ana…

…lytics into develop
nhsconnect · May 31, 2024 · 1ab6a9f · 1ab6a9f
2 parents c4affd8 + 7deea39
commit 1ab6a9f
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/README.md b/README.md
@@ -25,12 +25,11 @@
 
 This query works on the Splunk Cloud only:
 
-`index=spine2vfmmonitor (logReference=SSP0001 OR logReference=SSP0015 OR logReference=SSP0016) | transaction internalID maxspan=1h keepevicted=true | table _time, SspTraceId, sspFrom, sspTo, interaction, responseCode, duration, responseSize, responseErrorMessage, method | sort 0 _time
-`
+`index=spine2vfmmonitor (logReference=SSP0001 OR logReference=SSP0015 OR logReference=SSP0016) | transaction internalID maxspan=1h keepevicted=true | table _time, SspTraceId, sspFrom, sspTo, interaction, responseCode, duration, responseSize, responseErrorMessage, method | sort 0 _time`
 
 This query works on the Spine instance of Splunk only (i.e. Live A + Live B):
 
-`index=spinevfmlog (logReference=SSP0001 OR logReference=SSP0004 OR logReference=SSP0012) | transaction internalID startswith=SSP0001 endswith=SSP0004 keepevicted=true maxspan=1h | table _time, sspFrom, sspTo, SspTraceId, interaction, responseCode, duration, responseSize, responseErrorMessage, method | sort 0 _time`
+`index=spinevfm* logReference IN (SSP0001, SSP0004, SSP0012) | transaction internalID startswith=SSP0001 endswith=SSP0004 keepevicted=true maxspan=1h | table _time, sspFrom, sspTo, SspTraceId, interaction, responseCode, duration, responseSize, responseErrorMessage, method | sort 0 _time`
 
 ### 3. MESH send document transactions