...o get the total number of events, and data set size. Then ran the same search with the dedupcommand to reduce out all the duplicate events..... | dedup _time _raw The problem is the dedupcommand...
...ollowing messages:
Search auto-finalized after disk usage limit (10000MB) reached.
The sort command is truncating output to 10000 rows
Any ideas on how to optimize this search so I don't need t...
Good Afternoon, TLDR; Can a search query result that provides more than 1 field be outputted to a file with a command like outputlookup and have its multiple fields compared against for later usage...
...clientId | table domains{}, extensionBundlesCount | sort -extensionBundlesCount The error: command.mvexpand: output will be truncated at 37800 results due to excessive memory usage. M...
Our purpose is to get the most recent event with specific fields by "dedup" command in indexer cluster
We have read a similar case according to this link, but still confused about the usage of dedup...
Hi Community,
I have the below search query
index=_internal
[ `set_local_host`] source=*license_usage.log* type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(S...
...t;"
| table Server,Region,Environment,Server_IP,Filesystem,Type,Blocks,Used,Available,Usage,Mounted_On | dedup Server,Region,Environment,Server_IP And below is the table I am g...
....mvexpand: output will be truncated at 28200 results due to excessive memory usage. Memory threshold of 500MB as configured in limits.conf / [mvexpand] / max_mem_usage_mb has been reached....
...n event when the difference in the CPU usage between the last two values is more then the configured threshold, whether it drops or increases. Maybe I am going about it the wrong way with the Delta command...