i get output of a query as below, i would like to pass the output of this query to the of my code but the is not supporting the time format generated by the query so please help in changing the time format
output = AUDIT_TIME="2018-06-05 21:00:02"
index="jboss" AUDITDATA="XXXXX" AND AUDITDATA=""XXXX8"" AUDITTIME>="2018-06-05 21:00:00" | table AUDITTIME | sort AUDITTIME | uniq | sort 2 AUDITTIME | reverse | return AUDIT_TIME
i wanna pass this output value AUDIT_TIME in
Hi @PowerPacked and @sukisen1981
I'm going wrong somewhere 😞 can you please check and correct me i have modified the query and tried for my case but its not working 😞
this is my sample data
2018-05-14 14:25:00,108 INFO com.xxxxxxx.browser.servlets.BrowserServlet 123-132-0-23-0
2018-05-14 14:25:00 -> i wanna pass this part as the input for the tag $earliest$
use this query to extract the time from result.
index="jboss" AUDIT_DATA="XXXXX" AND AUDIT_DATA=""XXXX8"" AUDIT_TIME>="2018-06-05 21:00:00" | table AUDIT_TIME | sort AUDIT_TIME | uniq | sort 2 AUDIT_TIME | reverse | return AUDIT_TIME | rex "AUDIT_TIME=\"(?P<time>.*)\"" | fields time
i wanna pass the AUDIT_TIME in
<panel> <table> <title>Dynamic drilldown Jboss Request/Response</title> <search> <query> **Query that will return AUDIT_TIME** </query> **<earliest>$earliest$</earliest>** - **should pass the audit time here** <latest>$latest$</latest> </search> </table> </panel>
This is jest an example snippit may have some more errors too hope this helps us to understand where we have to pass the AUDIT_TIME..
Thanks for the support in advance.