I want to create a single value panel that starts at 100, and when a specific alert goes off with an assigned weight, that weight is removed from the single value panel. So alert with a weight of 25 fires, the single value panel is now at 75 which is yellow. Greater than 80 is green 50-80 is yellow below 50 is red I have this search: index="nitro_prod_summary" earliest=-1h@m latest=@m [| `nitro_prod_cmdb` | search Category="ECOMM CUSTOMER FACING" OR Category="ECOMM OPERATIONS" Service="*" Application="*" weight="*"| stats count by Application | table Application] | join Application [ | `nitro_prod_cmdb` ] | search Alert_Type="*" Metric_Category="*" | eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | sort +Alert Which creates a table like this: I want to create this single panel for "webstore" so I want to filter from the search above only Application="WebStore Services" then add the weights from all of the instances and subtract it from 100, if this number is greater than 80 it is green, 50-80 is yellow and below 50 is red. It should also still say webstore and the color should be responding to that number. I did not put weight into the table but it is being pulled from the alerts just not being placed anywhere. Any ideas on making this single value panel? Few extra points for this loaded question! ... View more

So I have a search that will check if two variables equal a specific number, and then I get the count of these instances. I am having trouble regexing the numbers I needed to create the variables. index=nitro_prod_ecomm errorCode |rex (This grabs the Response Code) | rex (This grabs Error Code) | where RespCode = 400 AND ErrorCode = 1001 | table count REQUEST_BODY: {profileId:0156",deviceId:D893-4324234234C"} RESPONSE_CODE:400 RESPONSE_TIME:2 RESPONSE_HEADERS: Date:Wed, 14 Sep 2016 15:10:17 GMT; X-Powered-By:Servlet/3.0; correlation-id:NAID-iOS-E6B4F6817.94320; channel:IOS; Content-Type:application/json; Transfer-Encoding:chunked; Connection:Close; RESPONSE_BODY: {"errors":[{"errorCode":"1001","message":""}]} _WS_HAPRT_WLMVERSION:-1; RESPONSE_CODE:500 RESPONSE_TIME:11 RESPONSE_HEADERS: X-Powered-By:Servlet/3.0; correlation-id:TID-14743243247; Content-Type:application/json; Transfer-Encoding:chunked; Connection:Close; Date:Wed, 14 Sep 2016 15:33:13 GMT; RESPONSE_BODY: {"errors":[{"errorCode":"1010","message":""}]} ... View more

I am trying to grab this response time **** info[[Path::/rest/motService][corRID::NAID-iOS-DFA65777-2339-4A0802F42C6055317][KEY::8ce38e4cf][SID::ZkQfAfff1QTnEbeEJkvk1jLwy2bA!-173731PID::NULL][UID::NULL][OID::NULL][Bous::false]] Mon Sep 12 10:28:09 CDT 2016 1473694089144 /atg/dypipeline/Actoervlet Time Consumed - 492 ms **** info[[Path::/rest/moProfileId][corRID::NAID-iOS-1AA-909C66C333C1-1473694078.419966][KEY::NUvxW9][SID::NtsfAzgu00iOHflb1o2o36_jFX!-1737314761!1473694087214][PID::NULL][UID::NULL][OID::NULL][Bous::NULL]] Mon Sep 12 10:28:07 CDT 2016 1473694087266 /atg/dypipeline/Actoervlet Time Consumed - 15 ms **** info[[Path::/rest/ment][corRID::MCID-1126012-1473694045379][KEY::oAEItJq][SID::bSUiIeRZ8OjzE8_3jXulwL!-173786261][PID::NULL][UID::NULL][OID::NULL][Bous::false]] Mon Sep 12 10:28:06 CDT 2016 147437 /atg/dypipeline/Actoervlet Time Consumed - 37 ms ... View more

I want to grab the 3 digit number and the words after, bolded. [INFO 16-09-08:19:39:10] @makeRequest HTTP REQUEST Uri : http://www.ve.com/delivery/api/tamy?taxonomy=Jewelry%20eatured&view=grid&usestate=1&platform=mobile&puserid=ee20b-7c49-25c4-975e-43903e8e47a9&minmes=1&maxmes=8&minorganic=3&creative=182x2464_T-RTI_1-8_RightColumnAjax&beacon=individual&apiKey=9CB-E021-43BF-A29B-87E4D166C38E&cUserid=&minPrice=100&maxPrice=500, HTTP RESPONSE : [responseCode= 200, responseMessage= HTTP/1.1 200 OK], Time taken = 6 msecs [INFO 16-09-08:19:37:58] @makeRequest HTTP REQUEST Uri : https://api-atfile/password/validate?token=K1JfXa3ulHz3POkrJViEzSw_EPfY., HTTP RESPONSE : [responseCode= 500, responseMessage= HTTP/1.1 500 Internal Server Error], Time taken = 170 msecs [INFO 16-09-08:19:42:18] @makeRequest HTTP REQUEST Uri : https://am/token, HTTP RESPONSE : [responseCode= 400, responseMessage= HTTP/1.1 400 Bad Request], Time taken = 167 msecs [INFO 16-09-08:19:42:19] @makeRequest HTTP REQUEST Uri : http://5/kohls/product/2508548?campaignId=271, HTTP RESPONSE : [responseCode= 200, responseMessage= HTTP/1.1 200 ], Time taken = 88 msecsme taken = 10 msecs (responseMessage=)\s(?\w*) Got this, but it doesn't grab everything, just the http part which isn't the part I want unfortunately. ... View more

I have http response codes, and I have hosts. I want my data to show both of them and how they correlate with each other, I am trying to picture what this would look like, but am having trouble. Basically this is my search: index=nitro_ecomm_rest http_Response_code="*" |table host http_Response_code This shows me every host and every response code. I would like something more along the lines of every response code with the percentage of a host that is in it so if host: alpha50 has 10 200 http responses and 90 400s under 200, it would show alpha50 10% 10 and under the 400 category 90% 90 This is something I will also be working on for a bit. ... View more

I have this statement: 10.211.1.114 10.222.3.33:4331 - 2016-09-07 14:10:06 0.004 GET /openapi-rest-web/akamai-object.htm - 200 6548 "Java/1.7.0_45" "54.444.444.444" - null [corRID::null] [KEY::-HTTPMonitor-Loyalty] [UID::-] I am trying to grab the 0.004 10.200.1.200 10.002.0.98:012 - 2016-09-07 14:40:06 0.39 POST /openapi-rest-web/v1/kohlsCash - 200 918 "Apache-HttpClient/4.3.3 (java 1.5)" "100.100.00.187, 144.41.141.00, 144.41.141.44, 54.009.200.002, 144.41.141.44" - null [corRID::NAID-iOS-98797AB9-2978-4987-90CA-059879789-1473276124.978987] [KEY::NUNlVg4532432523mLL8MEpqVvxW9] [UID::-] I am trying to grab the 0.39 I have this regular expression so far: ^.*(GET|POST) Which gets me everything before the GET or POST Any suggestions? ... View more

I have these statements I am trying to extract the "200" from, but this number could be any three digit number though. <117>Sep 01 16:19:12 ip-10-255-55-21 SLAVE[prodr35e-core_24322]: 10-255-55-21 10-255-55-21 - 2016-09-01 16:19:12 86 GET /search?keyword=true&sortKey=4&start=2100&count=s=false&marketPlace=true HTTP/1.1 ?keyword=true&sortKey=4&start=2100&count=60&s=false&marketPlace=true 200 33687 "Jak Commons-HttpClient/3.1" <117>Sep 01 16:19:12 ip-10-444-33-63 SLAVE[prodr35e-core_390959]: 10-444-33-634 10-444-33-65 - 2016-09-01 16:19:12 2 GET /index.html HTTP/1.0 200 1488 "-" <117>Sep 01 16:19:12 ip-10-999-39-99 SLAVE[prodr35e-core_390959]: 10.999.39.79 10.999.39.99 - 2016-09-01 16:19:12 252 GET /search?keyword=true&count=0&sendRefinements=false&marketPlace=true&isBOPUS=true&storeId=555&storeId=592&storeId=696&storeId=548&storeId=592 HTTP/1.1 ?keyword=true&count=0&sendRefinements=false&marketPlace=true&isBOPUS=true&storeId=555&storeId=592&storeId=696&storeId=548&storeId=592 200 973 "Jak Commons-HttpClient/3.1" <117>Sep 01 16:19:12 ip-10-200-00-00 SLAVE[prodr35e-core_489352]: 127.0.0.1 10.200.00.00 - 2016-09-01 16:19:12 0 GET /products/admin/beans?key=/select&stats=true&cat=QUERYHANDLER&wt=json HTTP/1.1 ?key=/select&stats=true&cat=QUERYHANDLER&wt=json 200 733 "Python-urllib/2.7" <117>Sep 01 16:19:12 ip-10-204-38-110 SLAVE[prodr35e-core_497105]: 10.222.22.22 10.222.22.222 - 2016-09-01 16:19:12 41 GET /search?&count=96&start=0&ltl=false HTTP/1.1 ?count=96&start=0&ltl=false 200 6903 "Java/1.7.0_55" I just can't seem to get my regex to work for all of these statements, help would be highly appreciated! ... View more

I have this stats table This is the search that creates it: index="nitro_application_summary" earliest=-1h@m latest=@m [| `nitro_prod_cmdb` | search Category="*" Service="*" Application="*" | stats count by Application | table Application] | join Application [ | `nitro_prod_cmdb_service_app_relationships` ] | search Alert_Type="*" Metric_Category="*" | eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | sort +Alert I want it so when I click the row, it grabs the category of the row I am clicking and inserts that into the URL This is my drill down in the XML <link> <![CDATA[ /app/nitro_app_summary/nitro_summary_details_view_sideview?Category= (This is where I want whatever is in the category section) ]]> </link> </drilldown> Any ideas? I do not want to use drop-downs or any selection tools. I want to be able to just click on the row and for it to open based on the category. ... View more

I am trying to extract the response time from this statement (Just the number, not the words response time or the ms behind it) Here is a regex statement I wrote ((response time: )(\w+)) this is splitting the number into the 3rd group but I am unsure as to how to remove the other two groups from the results as I need them to help with the matching aspect Here is the statement I am trying to extract from: <117>Aug 26 15:22:16 777-120 SLAVE[p-core_987734]: 2016-08-26 15:22:16,7t2 INFO [q44760481-48788] 6699-4871-a646-1b15556d queriesAndResponseTimeLogger - Client request: /search?keyword=tools+accessories&sendRefinements=false&count=3, response time: 70 ms, stage1Count=0, stage2Count=13, effectiveStage=STAGE2 The bolded number is the one I want ... View more