Hello,  I am searching to get results for each hour  top 1 max URL hits.  Iam using the below search but not getting results for each hour. index=*  | fields Request_URL _time | stats count as hits by Request_URL _time |bucket span=1h _time | sort by hits desc | head 1 Thanks in advance! ... View more

    "my base query 1 to Total _count_of_sucess_transactions" | rex "URI\s*(?<URI>[^\=\n]+)" "my base query 2 to trackTotal _count_of_Failed_transactions" | rex "gov\^*(?<URL>.*)"     I want the below table to be shown 1)  column 1 Total count of Success transactions  2)  column 2 Total count of Failed Services 3) column 3 Percent of success rate    ... View more

Hi, I need  to extract the below events i tried this  | rex "URI\s(?<URI>.+?)="   but not working. i want to extract for the 1& 2 events before the "=" URI /api/Hellothisistest?customerNumber=244479 URI /api/Hellothisistest?customerNumber=247370 URI  /api/Getthisextractessample URI  /api/createthisextractesof URI  /api/liverpooltestsoccer   Thanks in Advance   ... View more

Hi I am using the below query and i need the results in hourly basis for the time i selected ?   "My Base search"   | fields TRAN_TIME_MS PAGE_ID PAGE_TITLE _time| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | where TRAN_TIME_MS <= Percentile | stats count avg(TRAN_TIME_MS) as avg_time max(TRAN_TIME_MS) as max_time by PAGE_ID,PAGE_TITLE, | eval avg_time=round(avg_time/1000,2) | eval max_time=round(max_time/1000,2) | rename count as Total_Requests avg_time as Average(Seconds) max_time as Max_Time(Seconds) PAGE_ID as Page_ID PAGE_TITLE as Page_Description   ... View more

Hello  - I am getting the below error. I am trying to add pipe "|"  for all the results.  Error : Failed to parse templatized search for field 'ResponseTime(ms)' My search :  | table PeriodDate VendorName ContractName OccMetricCode Pagekey TransactionType TransactionDatetime ResponseTime(ms) Comment | foreach * [ eval <<FIELD>>="|".<<FIELD>>."|"]    I am not getting pipe seperated results only for ResponseTime PeriodDate  ResponseTime(ms)  Comment  |2022/08/30| 0 ||   Thanks in advance   ... View more

How Can i just get the message alert in mail showing only the  failed job example "Job=[ADM-FILENET-DLY]] " instead of the complete log.   Note: The Job names are dynamic    My Current Alert Query : index=* host=*MYhost* "*IN-RCMCO-DLY*" OR "*ADJ-RECERT-DLY*" OR *AD*-*Y*" FAILED job_status2=FAILED OR status=FAILED OR status1=FAILED OR ExitCode=FAILED | rex field=_raw ".*status:\s\[(?P<status1>\S+)\]" | rex field=_raw "JOB\s(?P<job_status2>\w+)" |rex field=_raw "(exitCode=)(?<ExitCode>\w+)" | eval _raw=substr(_raw, 1, 1500) | table _time job_status2 status1 status ExitCode _raw   log  22-08-28 18:01:31,323 INFO [main] c.l.b.listener.JobCompletionListener: :::::::::::::::BATCH JOB FAILED:::::::::::JobExecution: id=21099, version=1, startTime=Sun Aug 28 18:01:29 CDT 2022, endTime=Sun Aug 28 18:01:31 CDT 2022, lastUpdated=Sun Aug 28 18:01:29 CDT 2022, status=FAILED, exitStatus=exitCode=FAILED;exitDescription=com.ltss.fw.exception.ApplicationException: Error occured while processing appDocument: In catch block, exception stackTrace,job=[JobInstance: id=21099, version=0, Job=[ADM-FILENET-DLY]], jobParameters=[{chunkSize=null, skipLimit=null, commitInterval=null, time=1661727689449, asOfDate=1661662800000}] ... View more

Hello,  when i table the results the results are not matching exact with the next columns. what can i add to reslove this issue. Please find the below screenshot for the results. |rex field=_raw "(TEST_DETAIL_MESSAGE\s\=)(?<MESSAGE>\w+\D+\,)" max_match=0 |rex field=_raw "(TEST_COUNT\s\=)(?<COUNT>\s\d+)" max_match=0 | table MESSAGE COUNT     ... View more

Hello,  Can someone  Please help to build rex for field extraction in one event. Currently iam using the below basic rex but its pulling only first line in the results. i need all the results so i can table them. |rex field=_raw "(TEST_DETAIL_MESSAGE\s\=)(?<MESSAGE>\w+\D+\,)" |rex field=_raw "(TEST_COUNT\s\=)(?<COUNT>\s\d+)"   ... View more