I have about 10 million events in one index and my manager wants me to split them up differently than they currently are. So I went into the props.conf and wrote some regex to correctly split the logs. Now I want to have those logs split retroactively from the first event. My question.. Would this be possible if I were to delete the forwarder off the server then re-install the forwarder with the changes in my props.conf? ... View more

I have a web service called CreateOrder.. This has a request and response which has a unique identifier called a GUID. In the CreateOrderRequest, it has the AffiliateData which I did a field extraction for (AfData) and in the CreateOrderResponse I did another field extraction for the CreateOrderID. I piped my search into a Transaction using the GUID so now each event has a request and response for CreateOrder. I want 2 columns, one showing the AffiliateData (AfData) and the second column showing the CreateOrderID.. The current way I have it set up, it's showing the data but when I do a search for the CreateOrderID, the wrong Affiliate Data is showing up. I need the Affiliate Data to match the CreateOrderID. Everything is correct up until the last pipe index=unleashed Call="<CreateOrder*" | transaction GUID startswith="fterReceiveRequest" endswith="BeforeSendReply" | stats list(AfData),list(CreateOrderID) ... View more

I made a dashboard which has 2 pie charts and their status codes. How do I include a legend showing what the status codes mean? Example, one pie chart shows only 3 status codes so far for today (200, 400, and 699). status code = 200 means a successful web service call status code = 400 means an unsuccessful web service call status code = 699 means failed payment method I want a legend to show up which gives a description of what the status codes represent so anyone looking at the dashboard could instantly know without having to go ask or look it up ... View more

I have 3 different status codes which I need extracted, the words around them will be fixed and never change I will have 3 different status codes (200, 400, 0) So far I have ^StatusCode>(?P<StatusCode>\d{1,3}) It will always look like this <a:StatusCode>200</a:StatusCode> <a:StatusCode>400</a:StatusCode> <a:StatusCode>0</a:StatusCode> ... View more

I'm doing an extraction for Jsession ID's. I'm writing the regex myself and after previewing the events, it correctly captures 100% of what I need it to. Now after I save it and look for it in on the left in 'Fields', it's nowhere to be found. I also tried typing it into my search Jsession="*" with no luck. I'm also open to suggestions if anyone can provide regex to capture the alphanumeric Jsession ID which always has 32 characters There is < and > before and after the word jsession but this website won't show it in the code Here's my regex (?PJsession)([0-9A-Z]{32}) ... View more