thank you for the answer, i'll try that and let you know. ... View more

Hi the 3 files are 1.json, P1_job.json, P1_task.json. The file 1.json has project name as a field and the other 2 files has project name in their file name. Is there a way that i can achieve this by using sub search? ... View more

thanks @manjunathmeti for the response! i'll try this and let you know. ... View more

hi @to4kawa , thanks for the response. I tried this and i'm only getting , A_NAME dept{}.D_NAME dept{}.PROJECT{}.PROJECT_NAME these fields in the table. Why is that so? ... View more

Thank you for the answer i'll try it out and let you know.The main file is not P1.json it's 1.json and P1 is a project name which is a field of that file. The only term common to all the files is the name of project in the file name that is in this example "P1". The files are 1.json,P1_job.json,P1_task.json The project names are in 1.json, which are being used in the file names of other two. Is there any way that i can do sub search ? ... View more

Hello @gcusello , thanks for the response. I have 3 json files. The names of the PROJECT is in 1.json and the details of PROJECT will be in P1_job.json and P1_task.json. 1.json { "A_NAME" : "aaa", "dept" : [{ "D_NAME" : "D1", "PROJECT" : [{ "PROJECT_NAME" : "P1" }] }] } P1_job.json { "JOB_NUM" : "1", "JOB_TIME" : "1/1/2020", "JOB_STATUS" : "PASS", "JOB_DURATION" : "304" } P1_task.json { "TASK_NUM" : "1", "TASK_TIME" : "10/2/2020", "TASK_STATUS" : "FAIL", "TASK_DURATION" : "239" } I want a table consisting of A_NAME,D_NAME,PROJECT_NAME,JOB_NUM,JOB_TIME,JOB_STATUS,TASK_NUM,TASK_TIME,TASK_STATUS (There are a lot more data in json file but here i posted a small part of it ). I have tried using subsearch i couldn't able to get the proper result. Can you please help me in this!! ... View more

HI @vnravikumar , can i use where command to print the fields which of $max_num$? I have tried it and not getting any result. My file is in json format. ... View more

hi @niketnilay once again thanks a lot for the help, i didn't find an option to accept you answer. Can you please tell me where can can i find it? Thanks for the suggestion @niketnilay , i'm thinking of changing it to narrowed search and it also has options like last day, last week etc.. ... View more

hi @vnravikumar , i tried using your code , thank you so much it is working! ... View more

hi @niketnilay , thank you so much for the answer. It is working !! ... View more

hi @manjunathmeti , thank you so much!!! It is working, and i am getting all the fields of the json file. ... View more

hi @to4kawa , no my json is not a one line file. ... View more

[_json] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) disabled = false TIME_FORMAT = %m/%d/%Y %H:%M:%S %z TIME_PREFIX = \"START_DATE\": \" MAX_TIMESTAMP_LOOKAHEAD = 128 BREAK_ONLY_BEFORE_DATE = This is props.conf file. ... View more

hi i tried that and i'm still getting as "Failed to parse timestamp". How can i include the END_DATE aslo? ... View more

Hello @niketnilay , yes i'm using INDEXED_EXTRACTION=json in props.conf. I want to consider all the json files that i have uploaded so far. We can use a separate query to find the largest number, but is there any way that i can find it in init? ... View more

Thank you! I'll try this and let you know. ... View more

Hello, @niketn , i am not able to post any screenshot here as i have less karma points. I have multiple json file which are indexed. source="abc_*" index="myindex" sourcetype="_json"| table NUM So This the query from which i get NUM. I want the largest NUM to be used in my dashboard, and that value should be assigned to the token automatically when the dashboard is opened. Is it possible to find that largest value like this? <eval token="num">max(NUM)</eval> or should i write separate query to find that number? ... View more

Hi @niketnilay , sorry for that! I have a json file which has a field called "NUM". I want to use the largest value of NUM as token. Is there any way that i can achieve this? can i get the largest value like this? <eval token="num">max(NUM)</eval> ... View more

I want to use the largest value of "num" field of json file as token. As the data is dynamic the largest value may change accordingly. Yes the json data is indexed. Is there any way to achieve this? ... View more

The field "num" is in my json file. ... View more

hi @vnravikumar , thanks for answering. Is there any way to use max function in the init block? i have a field called "num" in my file. I want to use the largest number as token. <eval token="temp">max(num)</eval> can i modify my code like this? ... View more

Hi, @to4kawa , thanks a lot for the answer, i'm getting the results properly by your query as well as @kamlesh_vaghela s query. Thank you so much for the help!! ... View more