Try this workaround.
index=<claims_index> geico | eval temp=_time | fields - _* | eval _time=temp | fields - temp| table _time *
| untable _time fieldname fieldvalue | where match(fieldvalue,"geico") | xyseries _time fieldname fieldvalue
Try this workaround.
index=<claims_index> geico | eval temp=_time | fields - _* | eval _time=temp | fields - temp| table _time *
| untable _time fieldname fieldvalue | where match(fieldvalue,"geico") | xyseries _time fieldname fieldvalue
Not sure if I can grasp it ; -)
Formatted a bit -
index=<claims_index> geico
| eval temp=_time
| fields - _*
| eval _time=temp
| fields - temp
| table _time *
| untable _time fieldname fieldvalue
| where match(fieldvalue,"geico")
| xyseries _time fieldname fieldvalue
This claims_index
is huge and since we search explicitly for geico
, the query is very slow. Is there a way to see intermediate results? It can run for many hours...
There are some element in the query to clean fields (remove all _
fields but preserve _time), so looks weird.
YOu can reduce the time range and/or add a head
command after the base search to process only few rows for testing.
index=<claims_index> geico | head 1000
| eval temp=_time
| fields - _*
| eval _time=temp
| fields - temp
| table _time *
| untable _time fieldname fieldvalue
| where match(fieldvalue,"geico")
| xyseries _time fieldname fieldvalue
So, I ran the following -
index=<claims_index> geico
| head 50
| eval temp=_time
| fields - _*
| eval _time=temp
| fields - temp
| table _time *
| untable _time fieldname fieldvalue
| where match(fieldvalue,"geico")
| xyseries _time fieldname fieldvalue
It finished and said - 50 events (before 4/13/17 10:35:24.000 AM)
but no results are shown.
Can you run the query in parts and see which step the data goes away? (run everything before untable and then keep adding rest)
Perfect - I'll do so...
Let me accept it meanwhile ; -) much much appreciated!!!!