Hi All, my solution foresees a heavy forwarder that sends data to an indexer, in the transforms.conf file I have a regex, which allows me to filter through string only the lines I need regex example REGEX = ^.*(?:SIMONE|MARCO).* file.log example to monitor xxxxx|xxxxx|xxxxx|SIMONE|xxxxx|xxxxx|xxxxx xxxxx|xxxxx|xxxxx|VALERIO|xxxxx|xxxxx|xxxxx xxxxx|xxxxx|xxxxx|SILVIA|xxxxx|xxxxx|xxxxx xxxxx|xxxxx|xxxxx|MARCO|xxxxx|xxxxx|xxxxx I am acknowledging these errors ERROR Regex - Failed in pcre_exec: Error PCRE_ERROR_MATCHLIMIT for regex: WARN regexExtractionProcessor - Regular expression for stanza xxxxx exceeded configured PCRE match limit. One or more fields might not have their values extracted, which can lead to incorrect search results. Fix the regular expression to improve search performance or increase the MATCH_LIMIT in props.conf to include the missing field extractions. I wanted to know if there is a different way to filter the data to send without regex? Best Regards, Simone ... View more

Hi All, I have a Dashboard, with the count of completed requests   COMPLETED   46018   12003   1889   1   4   7 TOTAL 59922   if I add the separator | eval COMPLETED= tostring(COMPLETED, "commas")   COMPLETED   46,018   12,003   1,889   1   4   7 TOTAL 12   the total of Dashbord becomes 12. I would like it to become on the total 59,922 how can i solve?   by Simone ... View more

Hi All, i have a dashboard with loading a loadjoab, I would like to add a button to stop loading data. is it possible to do this? Simone ... View more

hi  I have a column with the following name transactionId: N/A the value after :  it can take on more values  transactionId: start how can I rename it so that it always takes the value transactionId ? Thanks for your help 🙂 Simone     ... View more

hi All, is it possible to set a global token? preset that all dashboards read that value? for example $env:user$ thank you Simone ... View more

Hi all, I have a column containing Request = REQ_IN ...... { ...... "productId": "test", ...... { ....... "productId": "test2" }} I have to take the containing value in the first one productId test I using = | rex field=Request "REQ_IN.*\"productId\"(?<productId_rex>[^,]*)" but it returns me the second value test2 how can i solve? Simone ... View more

Hi All, I'm in this situation index a   index b id  neme   id neme 1 simone   1 simone 3 francesco   2 marco 4 luca         I have a scheduled search that extracts data from index a and writes it to index b. as you can see in both index a and b there is id = 1. my search currently duplicates the result this way index b id neme 1 simone 2 marco 1 simone 3 francesco 4 luca   is there a function merge type sql? the expected result is the following index b id neme 1 simone 2 marco 3 francesco 4 luca   can you help me? thanks for any answer Best Regards, Simone ... View more