I am creating an alert where the time range should be from 7 to 18 and corn schedule is for 5 mins So in my alert if i give earliest=@d+7h and latest =@d+18h will this works?? And i dont want to receive alert after this time range. how i can do this?? ... View more

Hi All, below are the sample logs: can i get props for this sample logs.   ------------------------------------------------------------- Time: 02/12/2021 01:45:05.777 Message: there is a exception error code gg456hhhrgh34567 type: application code data: system ------------------------------------------------------------- ------------------------------------------------------------- Time: 24/12/2021 01:45:05.777 Message: there is a exception error code 897fghj56879hgj type: application code jobs data: system jobs -------------------------------------------------------------       ------------------------------------------------------------- Time: 28/12/2021 02:54:15.767 Message: there is a exception error code 89hjyt5643edhjjy656 type: application code error data: system error ------------------------------------------------------------- -------------------------------------- Timeline: 12/02/2021 12:44:32.667 Message Details - Application code contains error at 12/02/2021 11:30:00.212 -------------------------------------- -------------------------------------- Timeline: 23/02/2021 10:23:22.124 Message Details - Application code contains error at 12/02/2021 08:20:10.100 -------------------------------------- -------------------------------------- Timeline: 24/02/2021 10:20:12.667 Message Details - Application code contains error at 24/02/2021 07:10:23.112 --------------------------------------     ... View more

Search: index=xxxx sourcetype=xxxxx home_feature!=connectapp application_name IN(artical, login, management, pageout) |table Description application _time count |sort Description _time home_feature application_name streamstats current=f window=1 values( Description) as desp values(home_feature) as app values(_time) as totaltime values (count) as totalcount |eval siml=if(home_feature == app AND Description == desp, count - totalcount,0) |eval siml2=if(siml <0, Count, siml) |where siml2 > 0 |eval time=strftime(now(), %d/%m/%YT%H:%M:%S) |stats sum(value) by home_feature, application_name Output: home_feature application_name sum(value) ampt.gc.com login 298 ampt.gc.com pageout 2341 https:gtt.com artical 4567 wcw.gft.com management 678 app.df.com login 499 rt.hj.com pageout 567 tt.com artical 345 ggt.com management 178   but i need the output as shown below: _time home_feature login pageout management artical 03/02/2023T14:05:15 ampt.gc.com 298 100 678 567 03/02/2023T12:05:15  ampt.gc.com 345 345 12341 789 03/02/2023T11:05:15  https:gtt.com 100 45678 9087 4567 03/02/2023T10:05:15  wcw.gft.com 456 567 678 789 03/02/2023T09:05:15  app.df.com 900 345 23499 3215 03/02/2023T08:05:15  rt.hj.com 789 125 567 678 03/02/2023T06:05:15  tt.com 12 34 345 45 03/02/2023T04:05:15   ggt.com 23 14 178 34   how to achieve this? ... View more

I have to set up an alert with corn schedule from 9pm to 7am. when i tried to get it from crontab it was not coming. how can i create the corn schedule  for this timings. ... View more

Hi All, how can i know whether props has been defined to particular sourcetype. how can i check it. ... View more