Hello, I have a text source file with header. Some sample events (first line is a header) and props that I wrote given below. My props is working ok, except it breaks the events at TEST\2qw123|Employee, TEST\3eraa2|Employee, TEST\87xaqw|Employee, at Obj.BasePage.Page, TEST\m69xcb, at Obj.BasePage.Page, and TEST\7yxccd|Employee  instead of breaking events at  TEST\2qw123|Employee, TEST\3eraa2|Employee, TEST\87xaqw|Employee, TEST\m69xcb, and TEST\7yxccd|Employee .  So from following sample events, I should have 5 events , but getting 7 events. Any help will be highly appreciated. Thank you.  UserID|UserType|System|EventType|EventID|Subject|SessionID|SrcAddr|EventStatus|TimeStamp|AdditionalData|DeviceID|DestSrcAddr TEST\2qw123|Employee|COM|TESTUSER|NTINCheckKCase|089524234|ybzjlie3d4ayr1i2|10.212.48.121|00|20220217122935|Case Information request: (Case-170) - 201612-30|mct0ma01ma4352855|10.219.174.222 TEST\3eraa2|Employee|COM|TESTUSER|NTINCheckKCase|046453942|ybzjlie3d4ayr1i2|10.212.48.121|00|20220217123142|Case Information request: (Case -85) - 201912-30|mct0ma01ma4352855|10.219.174.222 TEST\87xaqw|Employee|COM|SYSTEM|SystemMsg||zsod0mvomcelp3hvln5smm1u|10.216.22.17|01|20220217124743|Type:'error'; Ref:'Case/CaseInventory.aspx?Query=true&Scope=ServiceWide'; Msg: experienced <br>Source: App_Web_pc<br>Message: Object reference not set to an instance of an object.<br> /Case/CaseInventory.aspx<br>Trace: at Case.CaseInventory() at Obj.BasePage.Page_Load(Object sender, EventArgs e)<br><br>Please try to login again.|mct0ma01ma4382154|10.210.174.221 TEST\m69xcb|Employee|COM|SYSTEM|SystemMsg||z0ae3c25zggbzx5p|10.215.173.231|01|20220217130933|Type:'error'; Ref:'Case/CaseInventory.aspx?Query=true&Scope=ServiceWide'; Msg: experienced a error:<br><br>Source: App_Web_pcf3kniw<br>Message: Object reference not set to an instance of an object.<br> /Case/CaseInventory.aspx<br>Trace: at Case.CaseInventory.page_load3() at Obj.BasePage.Page_Load(Object sender, EventArgs e)<br><br>Please try to login again.|mct0ma01ma4353159|10.210.174.221 TEST\7yxccd|Employee|COM|TESTUSER|NTINCheckKCase|008422123|zggbzx5pzgnw1nih|10.215.173.231|00|20220217131108|Case Information request: (Case -24) - 202112-30|mct0ma1ma4353159|10.210.174.221   [sourcename] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) INDEXED_EXTRACTIONS=psv MAX_TIMESTAMP_LOOKAHEAD=14 HEADER_FIELD_LINE_NUMBER=1 TIME_FORMAT=%Y%m%d%H%M%S TIMESTAMP_FIELDS=TimeStamp TRUNCATE=2000

I have the following data :    Service Message Service1 Hello world Service2 Another message Service1 Hello world Service1 Some other message   How can I write a query such that the final output looks like :  Service : Unique message : count For example :  Service1 : Hello World :   2 Service1:Some other message : 1 Service2: Some other message

I have the following data :    Service Message Service1 Hello world Service2 Another message Service1 Hello world Service1 Some other message   How can I write a report such that the final output looks like :  Service Message : count   For example, with the data above, it should be :  Service1 Hello world : 2 Some other message : 1 Service 2 Another message : 1

Considering a field like :  field=select id from table where id In ["123","12"] limit 1 field=select id from table where id="123" limit 1   How can I write a query so that all the values in quotes are replaced by a placeholder? For example, an ideal output would be :  field=select id from table where id In ["xxx","xx"] limit  field=select id from table where id="xxx" limit 1   The values within quotes are alphanumeric

Hello everybody, This is actually my first post here so forgive me if I missed up or posted in the wrong section. I'm trying to compare/corelate two fields values from different source types and same index. Please find two sample of event I'm trying to work on. 1) sample of the first source type index=wineventlog sourcetype=Script:ListeningPorts host=computer1 dest=172.*.*.* dest_port=50000 process_id=151111   2) sample of the second source type index=wineventlog sourcetype=WinHostMon source=process host=computer1 Path=***.exe Process=**.exe ProcessId=151111    I'm trying to corelate process_id and ProcessId fields to get the process field and make a count table. Sample output: process_id   |  dest_port  |  count   |  host               |  Path      |  process 151111               50000              1          Computer1      **.exe      **.exe   I tried this query but it didn't give me the right result index=wineventlog sourcetype=Script:ListeningPorts dest="172.*.*.*" host="Computer1" | table host process_id dest, dest_port | rename process_id as ProcessId | join type=inner host ProcessId [search index=wineventlog sourcetype=WinHostMon | table  ProcessId dest_port host Path process]    

These are ticket platform logs with field 'lastupdated' which contains time and date [2022-04-12 12:12:17.160000+00:00] . Trying to build a weekly chart where only results that contains "lastupdated" after present weeks monday should be displayed.  Something like  if ( lastupdated > monday)