How to add multiple attributes in single query

aditsss — Thu, 25 Mar 2021 06:16:46 GMT

Hi Everyone,

I have one requirement.

I am creating one alert and the query is below:

index=abc ns=blazepsfpublish "NullPointerException" | rex "message=(?<ExceptionMessage>[^\n]+)"|dedup ExceptionMessage,ns|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")|table app_name, ExceptionMessage ,_time, environment, pod_name,ns|rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name

My requirement is that I have multiple 6-7 ns and I want to include them in same query rather then appending.

Can someone guide me on this .

Below are my ns names:

sidh-datagraph

datagraph

etc

How can I include all ns in single query

Re: How to add multiple attributes in single query

bowesmana — Thu, 25 Mar 2021 06:27:26 GMT

Use IN like this

index=abc ns IN ("blazepsfpublish", "sidh-datagraph", "datagraph") "NullPointerException"

Or use OR like this

index=abc (ns="blazepsfpublish" OR ns="sidh-datagraph" OR ns="datagraph") "NullPointerException"

Hope this helps

topic How to add multiple attributes in single query in Dashboards & Visualizations

How to add multiple attributes in single query

Re: How to add multiple attributes in single query