without using lookup..atleast i need in updated or notupdated fields ... View more

|tstats latest(_time) as latestTime where index=* by index | eval latestTime=strftime(latestTime,"%Y/%m/%d %H:%M:%S") | eval status=if(strftime(latestTime, "%Y/%m/%d") != strftime(now(), "%Y/%m/%d"), "not updated", "updated") i'm using this query to find the index which is not indexed till today..For all the indexes i'm getting updated, eventhough there are indexes which are not updated a week.  ... View more

yes..the lookup column names are index and count ... View more

the join is not working ... View more

It did not help as the values are different for all the fields. Still got same index names twice ... View more

OK Finally I have a table as below |table _time index Count_Events hod dow lowerBound upperBound differencefromlowerbound differencefromupperbound Outlier_Low_index Outlier_High_index from this table, I want to create an alert only when the search result from the table is giving the same index name more than twice. If I give the stats command as below, I'm getting the Indexcount as 1 eventhough the index name appears twice because the events are not same. How to do it? |stats count as Indexcount by _time Events index hod dow lowerBound upperBound differencefromlowerbound differencefromupperbound Outlier_Low_index Outlier_High_index ... View more

But i need those small indexes as well ... View more

Out of the products, which are all the products that are not common across customers within a single division. How to find that, please   ... View more

You are right..Another query I have is.. Calculating the size of an index and triggering the alert. If an alert triggered for one index then it should not trigger the same alert  for next  2hour . But it should trigger alert for other indexes.   ... View more

But how to separate start_time and end_time   |table JOB, STARTTIME,ENDTIME,RUNTIME ... View more

***The query given is clubbing all the start time and endtime for each job and not giving the actual result** One of the job is running every 5min a day and these are the events. index=foo JOB_4185_u (STARTING OR SUCCESS) |table JOB MACHINE _time STATUS JOB MACHINE _time STATUS JOB_4185_u Machine1 20-07-2022 03:31 SUCCESS JOB_4185_u Machine2 20-07-2022 00:22 SUCCESS JOB_4185_u Machine1 19-07-2022 23:45 STARTING JOB_4185_u Machine1 19-07-2022 23:21 SUCCESS JOB_4185_u Machine2 19-07-2022 20:31 SUCCESS JOB_4185_u Machine1 19-07-2022 11:46 SUCCESS JOB_4185_u Machine1 19-07-2022 11:45 STARTING JOB_4185_u Machine2 19-07-2022 11:00 STARTING JOB_4185_u Machine1 19-07-2022 08:41 SUCCESS JOB_4185_u Machine2 20-07-2022 04:07 STARTING   But in the query , it is summing up all the starttime and end time for a job and giving it as a table with only two statistics eventhough there are 557 events matching. index=foo JOB_4185_u (STARTING OR SUCCESS) |stats min(_time) as STARTTIME,max(_time) as ENDTIME by JOB MACHINE |fieldformat STARTTIME=strftime(STARTTIME,"%F %T") |fieldformat ENDTIME=strftime(ENDTIME,"%F %T") |eval RUNTIME=ENDTIME-STARTTIME |table JOB MACHINE STARTTIME ENDTIME RUNTIME STATUS Complete 557 events (7/19/22 5:00:00.000 AM to 7/20/22 5:18:44.000 AM) JOB MACHINE STARTTIME ENDTIME RUNTIME STATUS JOB_4185_u xxxxx 19-07-2022 05:20 20-07-2022 05:16 86197   JOB_4185_u xxxxxxx 19-07-2022 05:00 20-07-2022 05:11 87103       ... View more

Thanks..It worked ... View more

I think i'm getting the result. But the time format is not in the actual time format.how to convert it   start end runtime 1658235600 1658235605 5     ... View more

Only value is JOB_Name ... View more

There is no common field like jobid or other related items ... View more

7/19/22 12:44:40.000 PM [07/19/2022 08:44:40] CAXXX_I_40245 EVENT: CHANGE_STATUS STATUS: STARTING JOB: PullMg_CreateHistory_job MACHINE: xxxxxxxxxx sourcetype = event_demon 7/19/22 12:47:42.000 PM [07/19/2022 08:47:42] CAXXX_I_40245 EVENT: CHANGE_STATUS STATUS: SUCCESS JOB: PullMg_CreateHistory_job MACHINE: xxxxxxxxxx EXITCODE: 0 sourcetype = event_demon ... View more