topic Re: Table creation without extraction fields in Dashboards & Visualizations

Table creation without extraction fields

aurora5 — Wed, 02 Jun 2021 04:03:54 GMT

Hi Everyone,

Please help me with my below query.

Sample Logs:-

I want my table to look like as below-

Thank you in advance!

Re: Table creation without extraction fields

kamlesh_vaghela — Wed, 02 Jun 2021 05:28:28 GMT

@aurora5
Can you please share _raw sample logs?

Re: Table creation without extraction fields

aurora5 — Wed, 02 Jun 2021 05:48:06 GMT

Re: Table creation without extraction fields

isoutamo — Wed, 02 Jun 2021 06:00:16 GMT

you could try this

.... | rex "Engine (?<ApplicationName>[^\s]+) (started|terminating)" | stats earliest(_time) as StartDate latest(_time) as EndDate by ApplicationName

This assume that there is only one start and end for any application. If there is more then you need to update this or use eg. transaction command. The depends on your data and how much you have it.

r. Ismo

Re: Table creation without extraction fields

aurora5 — Wed, 02 Jun 2021 08:51:17 GMT

Thank you for your quick response. It works now