Thanks, you guys have been a great helping solve these problems. ... View more

Thanks! It works, I forgot to add the second part of the condition: TOTAL_PIECES > 0. ... View more

Alert should trigger if:  There are any extracts where TOTAL_PIECES is >0 and the RETRIEVAL_ATTEMPT is = 10. I added AND TOTAL_PIECES > 0, but I'm not getting no result. The thing  is when I move that TOTAL_PIECES is >0  I get some data, but I need to trigger based on the condition above. Thanks ... View more

Thanks gcusello, What I want to do first is to filter based on :  If there are any extracts where TOTAL_PIECES is >0 and  RETRIVAL_ATTEMPT is = 99, I know that I have to add | fillnull for this field, but not working for me. Any advice please! ... View more

The subsearch actually finds the IP addresses that I'm looking for and everything looks great until the last line where I have :  | fields host_name count earliest_error latest_error  at this point the IP address changed to host_name with no output on the host_name field. Thanks ... View more

Thanks again for your quick response, please take a look at this: index=X sourcetype=Y "Failed handshake due to exhausted 10 seconds timeout on channel" earliest=06/16/2022:00:00:00 | rex field=_raw "(R:\/)(?<ip>[\d.]*)(:8609)" | stats earliest(_time) as earliest_error latest(_time) as latest_error count by ip | join type=left ip [| search earliest=-24h index=A  sourcetype=B  dv_u_eir=4311.00 | stats latest(dv_name) as host by dv_ip_address | rename dv_ip_address as ip] | eval earliest_error=strftime(earliest_error,"%m/%d/%Y %H:%M:%S"),  latest_error=strftime(latest_error,"%m/%d/%Y %H:%M:%S") | fields host count earliest_error latest_error ... View more

Thanks ITWhisperer, Just as an update, the field that I need to join on need to have the same exact name. Thanks ... View more

The host name will not be available in the web logs, that's why I  join to a different search using the ip_address to get the host name, even doing all of that still no luck! ... View more

It does not, it gives only field host . ... View more

This is the search: | rex field=_raw "(R:\/)(?<ip>[\d.]*)(:8609)" | stats earliest(_time) as earliest_error latest(_time) as latest_error count by ip | join type=left ip [| search earliest=-24h index=inventory_snow  index= X  sourcetype=server  dv_ir=4311.00 | stats latest(dv_name) as host by dv_ip_address | rename dv_ip_address as ip] | eval earliest_error=strftime(earliest_error,"%m/%d/%Y %H:%M:%S"),  latest_error=strftime(latest_error,"%m/%d/%Y %H:%M:%S") | fields host count earliest_error latest_error ... View more

I edited that already if you refresh you won't see it, that was a mistake. ... View more

Thanks for your fast response! The only thing that I'm struggling to get is the host name, So This is what I have so far: index=app  sourcetype=pw:ws "Failed handshake due to exhausted 15 seconds timeout on channel" earliest=06/16/2022:00:00:00 | rex field=_raw "(R:\/)(?<ip>[\d.]*)(:8609)" | stats earliest(_time) as E_error latest(_time) as L_error count by ip | join type=left ip [| search earliest=-24h  index= X  sourcetype=server  dv_ir=4311.00 | stats latest(dv_name) as host_name by dv_ip_address | rename dv_ip_address as ip] | eval E_error=strftime(E_error,"%m/%d/%Y %H:%M:%S"),  L_error=strftime(L_error,"%m/%d/%Y %H:%M:%S") | fields host count E_error L_error Just to clarify, what I'm trying to do in here is to create a new alert in the custom email template to notify if we receive handshake errors in the web logs. I had some of these errors on 5/20, so I need to adjust the time range to build/test the search and alert, for all of these I need to parse the ip_address out of the raw data. The alert should display : the host, number of handshake, time of first instance error on the host, and time of the recent error on the host.  ... View more

Sorry for that, the IP address I want to extract is the ipR:/56.201.45.41:8609. Thanks richgalloway! ... View more

Thanks for the follow-up. What is the distribution looks like, please? Thanks ... View more

So I would have triggered the alert many times compared to the number of hours where it wouldn't have triggered. How to play around with the standard deviation multiplication factor with (currently 15) to see if I can reduce the number of outbounds to inbounds. FYI:   app                                                     sum(in_bounds)                                                             SUM(OUT_BOUNDS)             Feed_file                                            12                                                                                            701              Feed_ingest                                     199                                                                                              501                                                                                                                                                                                                                                                 ... View more

Thanks again, IT Whisperer ! This works perfect, except I want to grab a sum of in_bound= true VS in_bound=false for each app. ... View more

Thanks ITWhisperer, I don't actually want to filter right away, what I want to do is that I want to add a column for upper threshold and lower threshold and then a third column for if the Volume is within the threshold or not.  And thanks again for always helping ! ... View more