Hi @gcusello , regarding #2, I added the fields I was looking for, I tried the below query sourcetype="mykube.source" "failed request"
| rex "failed request:(?<request_id>[\w-]+)"
| table ...
See more...
Hi @gcusello , regarding #2, I added the fields I was looking for, I tried the below query sourcetype="mykube.source" "failed request"
| rex "failed request:(?<request_id>[\w-]+)"
| table _time request_id user_name however, I did not get `user_name` as my output. the reason was user_name was not populated as part of my first search. user_name gets populated when I do search by the `request_id` (but this request_id is not known to me before first search). Issue here is, I can not write 2 separate queries, I need to club both the queries to get the final result