I want to use the values() function because I want to group by fields. If I just use count by I get the correct result but it doesn't look nice. If I use the values function the counts get swapped. this is how count by returns the results:  Function                  |    Status  |  count Authentication     |     Pass     |    10 Authentication     |     Fail       |      3 this is how the values() returns the results: Function                  |    Status  |  count Authentication     |     Pass     |    3                                     |     Fail       |     10 Here is the count by search:  | stats count by Function,  Status | table Function, Status, count Here is the values search: | stats count by Function,  Status | stats values(Status) as Status, values(count) as Count by Function | table Function, Status, Count So my question is how do I group by Function while getting the correct counts for the status.  

Hi All, I want to monitor files which keeps changing the filename according to the current date falling under respective month and year directory. Can anyone please help me out how can we monitor the same. I tried using wild card in the inputs.conf, but it seems to be not working. Format: D:\Logs\<dynamic-year>\<dynamic-month>\<dynamic-date>.txt D:\Logs\2022\04\21042022.txt I used the below config under inputs.conf [monitor://D:\Logs\*\*\*.txt] disabled = true crcSalt = <SOURCE> index = indexname sourcetype = sourcetypename   Many Thanks in Advance!   

Hi Folks, Need help to understand the requirement of "api-user" (Controller local User) with administrative rights for auto instrumentation using cluster agent on EKS. We have installed the cluster agent successfully into our EKS cluster and it is reporting data properly, now we are planning to achieve auto instrumentation of all the containers/pods running. While going through the documentation I found that there is a requirement to create a local user with an administrator role. I don't want to provide a local user with admin rights to the application team due to security concerns, Kindly suggest what else we can do here. Also, why AppDynamics is not using "API Client" token-based authentication instead of the user? Reference documentation: https://docs.appdynamics.com/21.4/en/infrastructure-visibility/monitor-kubernetes-with-the-cluster-agent/auto-instrument-applications-with-the-cluster-agent

Hello Community, How would I extract fields from raw data containing auto populated numbers in the fields I am trying to extract? The below example is field containing raw data. Notice the numbers inside the bracket.  The numbers are not the same for events and will auto change from 1 to 2 digits. For the below example, I would like to extract values for user_id, NAME, and Car. What would be the rex command? Event 1 for _raw field: user_id:[4] "peter1234" NAME:[10] "Peter" Car:[3] "Pinto" Event 2 for _raw field: user_id:[11] "peter1234" NAME:[5] "Peter" Car:[9] "Gremlin" Thank You for any assistance. Joe

Hi,   Can any one please help me with the query currently iam using " | rename * AS \|*\| "  but i don't want \  in the header  so i want  like  |PeriodDate| only. \|PeriodDate\| \|VendorName\| \|ContractName\| \|Code\| |2021/12/19| |SAM| |HI-HI| |511| |2021/12/19| |SAM| |HI-HI| |51.1| |2021/12/19| |SAM| |HI-HI| |51.1|