Hi @isoutamo , tried it but the result i am getting is same.. It does not consider the day in which there is no "Task". ... View more

@kamlesh_vaghela, thank you so much.. this helped me a lot. As you said i made some changes in the regular expression. Thank you so much once again. ... View more

Hi, @kamlesh_vaghela ,This is what the  "index | table _raw " looks like. I am not sure whats causing to be tmp to be not found in the query.     { "Info": { "Unit": "ABC", "Project": "XYZ", "Analysis Summary": { "DB1": { "Available": "1088kB", "Used": "173.23kB", "Used(%)": "15.92%", "Status": "OK" }, "DB2": { "Available": "4096kB", "Used": "1591.85kB", "Used(%)": "38.86%", "Status": "OK" }, "DB3": { "Available": "128kB", "Used": "0", "Used(%)": "2.6%", "Status": "OK" }, "DB4": { "Available": "16500kB", "Used": "6696.0", "Used(%)": "40.58%", "Status": "OK" }, "DB5": { "Available": "22000kB", "Used": "9800.0", "Used(%)": "44.55%", "Status": "OK" } }, "RAM_Tracking": { "a": "2", "b": "1088.0", "c": "32.1220703125", }, "Database2_info": { "a": "4", "b": "4096.0", "c": "654.3212890625", }, "Database3_info": { "a": "5", "b": "6696", "c": "9800", }, "Database4_info": { "a": "6", "b": "128.0", "c": "21.086", } } }                   ... View more

Hi @kamlesh_vaghela ,still it is the same. Actually my data is more, i have only written a few part of it in the question. if i use   | spath output=Analysis_Summary Info.Analysis_Summary | rex field=Analysis_Summary .....   will this be able to help? Below is my data.   { "Info": { "Unit": "ABC", "Project": "XYZ", "Analysis Summary": { "DB 1":{ "available": "1088kB", "used": "172.8kB", "used%": "15.88%", "status":"OK" }, "DB2 2": { "available": "4096KB", "used": "1582.07kB", "used%": "38.62%", "status":"OK" }, "DB3 3": { "available": "128KB", "used": "0", "used%": "0%", "status":"OK" }, "DB4 4": { "available": "16500KB", "used": "6696.0KB", "used%": "40.58%", "status":"OK" }, "DB5 5": { "available": "22000KB", "used": "9800.0KB", "used%": "44.55%", "status":"OK" } }, "Database1_info":{ }, "Database2_info":{ }, "Database3_info":{ } }}   Can you please help me. Not able to find out the mistake. ... View more

hi, @kamlesh_vaghela , still im getting as temp not found.. is it due to the new format of the data? is it becuase of new line? ... View more

Hi @kamlesh_vaghela , I have changed the file format to this, { "Info": { "Unit": "ABC", "Project": "XYZ", "Analysis Summary": { "DB 1":{ "available": "1088kB", "used": "172.8kB", "used%": "15.88%", "status":"OK" }, "DB2 2": { "available": "4096KB", "used": "1582.07kB", "used%": "38.62%", "status":"OK" }, "DB3 3": { "available": "128KB", "used": "0", "used%": "0%", "status":"OK" }, "DB4 4": { "available": "16500KB", "used": "6696.0KB", "used%": "40.58%", "status":"OK" }, "DB5 5": { "available": "22000KB", "used": "9800.0KB", "used%": "44.55%", "status":"OK" } } }} And Changed the query to | spath output=Analysis_Summary Info.Analysis_Summary | rex field=Analysis_Summary "\"(?<Database>[^\"]+)\":{ \"available\"\:\s\"(?<available>[^,]+)\",\"used\"\:\s\"(?<used>[^,]+)\",\"used%\"\:\s\"(?<used_p>[^,]+)\",\"status\"\:\"(?<status>[^}]+)\"}" max_match=0 | eval tmp = mvzip(mvzip(mvzip(mvzip(Database,available),used),used_p),status) | mvexpand tmp | eval Database=mvindex(split(tmp,","),0), available=mvindex(split(tmp,","),1), used=mvindex(split(tmp,","),2), used_p=mvindex(split(tmp,","),3), status=mvindex(split(tmp,","),4) | table Database available used used_p status But i am not able to collect the data.It says tmp does not exist.Is there any mistake in the regular expression? ... View more

Hi @bowesmana I got the time field like this. ... View more

hi @bowesmana ,Thank you so much, I tried, | bin _time span=1mon | stats count by _time user I am able to create a chart, but the span is not considered as 1 month, instead it is taking random spans and giving values. Is there any different way to specify span? ... View more

@bowesmanaThank you so much for the information. I will try to use that. Is there any method so that i can get monthly wise data apart from timechart? ... View more

Thank you so much.. It is working fine.. ... View more

Hi @kamlesh_vaghela , I have similar requirement, i referred your solution. But i am not able to print the row in the any one value has the data 0. Is there anything to be added in the query to avoid such condition? ... View more

Thank you so much!! Totally forgot about the use of fillnull! ... View more

I  tried like this too.. But in the when "SUCCESS" or "FAILURE" is zero the Total_Tasks column and the respective column which has zero value is shown empty. Zero is not considered and shown as empty. While doing the same for all groups they are coming proper. I want this to be for particular group. ... View more

Hi, @somesoni2 , the data is in json format. Here is one example. "Task_no":"5", "Group": "G1", "EXECUTION_DATE":1648081994535, "STATUS":"FAILURE", "DURATION":1951628   and the data im calculating is MTTR. .........[| streamstats count as start reset_on_change=true by STATUS | where start=1 | streamstats count(eval(STATUS=="FAILURE")) as fails by STATUS | eval fails=if(fails=0,null(),fails) | filldown fails | stats list(*) as * by fails| where mvcount(STATUS) = 2|eval MTTR=....] |append[.....| chart count(Task_no) by Group STATUS | table Group SUCCESS FAILURE] | stats values(eval(if('FAILURE'=="0",0,MTTR))) as MTTR Whenever there is no failures i want to make the MTTR as 0, if there are failures MTTR will be calculated by the query and i want to keep that result as it is. While using stats i am not able to achieve this condition. Where i went wrong in the query? Can you please help me. ... View more

Thank you so much for the help! It is working fine now.. ... View more

Okay.. Thanks alot for the information. There are some values like below.  "x,y":"32.064453125 this will be extracted as x and y as key and values. How can i extract "x,y"  as a key? ... View more

Thank you so much it is working.. Is it mandatory to use spath while using regex? Also some of the keys have comma because of key is splitting, how can i avoid this? How to escape comma present in key? ... View more

I have a big query where i calculate different data and join them into a table. When i changed the sort commands position i was able to get the required results. I am not sure how was this possible and how a sort command can impact the result. ... View more

Hi @PickleRick  , Thanks for the help. I was able to solve the problem. This was becuase of the sort command. The | sort Group command was in the beginning of the query , i placed it at the end and the stats max() was giving correct values. I don't know how the sort was affecting the values. ... View more