How to extract timestamp( is in bold text ) from the below event inside a file. Attached the source file. Each file content is considered as single event. currently it is taking file modification time as timestamp of the event. how to prevent this. 20150121 1 082142 08:21:42:379 99324 admin2 emergencey.2 0 xyz.23015521 too many times 150121082142379 ... View more

how to compare last month firstday data with current month firstday data and give the results if there is a change in particular field without using join? I am using the timerangepicker to select the date range in the dashboard. I am considering the earliest date as last month first day and latesttime as current month first day index="test_si" search_name=menu environment=$env$ | eval latest="$latest$" | eval enddate=if(latest=="now","@d",latest) | eval epochdayend=if(isnum(enddate), enddate, relative_time(now(), enddate)) | eval ldayend= strftime(epochdayend,"%Y%m%d") | lookup HolidayList Date as ldayend OUTPUT PreviousWDay as epochday | eval epochdayend=if(isnull(epochday),ldayend,epochday) | eval dateepoch=strftime(_time,"%Y%m%d") | where dateepoch=epochdayend | eval DATE=DATE_TIME | eval conc = coalesce(Menu_Id,"").coalesce(APPLICATION,"").coalesce(CO_CODE,"") | table Menu_Id DESCRIPTION APPLICATION CO_CODE DATE conc | dedup Menu_Id APPLICATION | join type=outer conc [ search index="test_si" search_name=menu environment=$env$ | eval begindate="$earliest$" | eval epochdaystart=if(isnum(begindate), begindate, relative_time(now(), begindate)) | eval ldaystart= strftime(epochdaystart,"%Y%m%d") | lookup HolidayList Date as ldaystart OUTPUT NextWDay as epochday | eval epochdaystart=if(isnull(epochday),ldaystart,epochday) | eval dateepoch=strftime(_time,"%Y%m%d") | where dateepoch=epochdaystart | eval DATE=DATE_TIME | eval conc = coalesce(Menu_Id,"").coalesce(APPLICATION,"").coalesce(CO_CODE,"") | eval conc1 = conc | table Menu_Id DESCRIPTION APPLICATION CO_CODE DATE conc conc1 | dedup Menu_Id APPLICATION] | where NOT conc = conc1 | sort 0 Menu_Id | fieldformat DATE=strftime(strptime(DATE,"%y%m%d%H%M"),"%d-%b-%Y") | fields - conc conc1 begindate dateepoch epochdaystart epochdayend enddate latest epochday ldayend ldaystart ... View more

how to send dbquery results to indexer for indexing from forwarder. |dbquery dtParts limit=300000 "SELECT * from dtPart1 WITH (NOLOCK) where Id > 12 order by Id desc;" ... View more

Hi, How to modify the Between dates default values under Date Range menu in the time range picker? Thanks ... View more

Hi, In the logs the START_DATE_PROFILE is in the format "20090914" i.e, (%Y%m%d) . I want to show the date as 14-Sep-2014 and the column name must be "Start Date". I am using this below query but the date is not sorting properly if we click on the column header. Please let me know. index=test24 | eval START_DATE_PROFILE=strftime(strptime(START_DATE_PROFILE, "%Y%m%d"), "%d-%b-%Y") | convert timeformat="%d-%b-%Y" mktime(START_DATE_PROFILE) AS START_DATE_PROFILE | fieldformat START_DATE_PROFILE=strftime(START_DATE_PROFILE,"%d-%b-%Y") | table START_DATE_PROFILE |rename START_DATE_PROFILE as "Start Date" ... View more