Hi @kamlesh_vaghela , Im getting as tmp does not exist. Not sure what is the problem. ... View more

  { "Info": { "Unit": "ABC", "Project": "XYZ", "Analysis Summary": { "DB1": { "Available": 1088, "Used": 173.23, "Used(%)": 15.92, "Status": "OK" }, "DB2": { "Available": 4096, "Used": 1591.85, "Used(%)": 38.86, "Status": "OK" }, "DB3": { "Available": 128, "Used(%)": 2.6, "Status": "OK" }, "DB4": { "Available": 16500, "Used": 6696.0, "Used(%)": 40.58, "Status": "OK" }, "DB5": { "Available": 22000, "Used": 9800.0, "Used(%)": 44.55, "Status": "OK" } } } } Hi @kamlesh_vaghela ,   This is the data. ... View more

Hi @kamlesh_vaghela , This is how the data looks. ... View more

I have changed the data as this in every section. "Available": 1088, "Used": 173.23, "Used(%)": 15.92, "Status": "OK" I have modified the rex to get numbers but unfortunately it gives as tmp not found. I am not sure what is the mistake. Used "\d+\.?\d*" to extract any numbers.     ... View more

Hi, @kamlesh_vaghela  How to use the query if the data is dynamic. That is { "Info": { "Unit": "ABC", "Project": "XYZ", "Analysis Summary": { "DB1": { "Available": "1088kB", "Used": "173.23kB", "Used(%)": "15.92%", "Status": "OK" }, "DB2": { "Available": "4096kB", "Used": "1591.85kB", "Used(%)": "38.86%", "Status": "OK" }, "DB3": { "Available": "128kB", "Used(%)": "2.6%", "Status": "OK" }, "DB4": { "Available": "16500kB", "Used": "6696.0", "Used(%)": "40.58%", "Status": "OK" }, "DB5": { "Available": "22000kB", "Used": "9800.0", "Used(%)": "44.55%", "Status": "OK" } }, "RAM_Tracking": { "a": "2", "b": "1088.0", "c": "32.1220703125", }, "Database2_info": { "a": "4", "b": "4096.0", "c": "654.3212890625", }, "Database3_info": { "a": "5", "b": "6696", "c": "9800", }, "Database4_info": { "a": "6", "b": "128.0", "c": "21.086", } } } As you see in the data "Used" is missing in DB3.But when i use this query i am not able to see any data related to DB3. In such cases how can i modify the query?can you please explain.. ... View more

I want to find the averages together with the days with zeroes being included.. ... View more

Yes. I guess that is the reason for the incorrect values. Any idea in how to resolve this? Or is it possible for to find averages for all the Groups together by any other way? ... View more

Hi @ITWhisperer , This is my sample data. This is only for one Task_no. There are many Tasks under a Group, likewise there are many Groups also. "Task_no":"5", "Group": "G1", "EXECUTION_DATE":1648081994535, "STATUS":"FAILURE", "DURATION":1951628 And this is the search i'm using, | bucket _time span=1d | stats distinct_count(Task) as counts by _time Group| stats avg(counts) as AverageCountPerDay by Group Actually i have table which combines all some of the calculated data using JOIN. The query is too big so only posted the search for the average. I have been trying to calculate average and trying to combine the data to my table. But the query which i used does not give the values correctly. I find the averages separately for a Group like this, |timechart span=1d distinct_count(Task) as Count| stats avg(Count) as Average   ... View more

Hi , @isoutamo tried this and i am not able to produce the average for all the Groups. Also is there a way to put these values as Group and Average as columns in a table? ... View more

hi, @ITWhisperer i tried and the table only has averages for few Groups. It doesn't show averages for all the groups. ... View more

Hi @isoutamo , still it is giving  different values. For finding out the average separately i use the following query. This is finding out the average separately for the "Group". |timechart span=1d distinct_count(Task) as Count| stats avg(Count) as Average My data has different "Group", so i want to create a table for the Group and the averages. But the timechart is not working if used for the groups.   ... View more

Hi @isoutamo , tried it but the result i am getting is same.. It does not consider the day in which there is no "Task". ... View more

@kamlesh_vaghela, thank you so much.. this helped me a lot. As you said i made some changes in the regular expression. Thank you so much once again. ... View more

Hi, @kamlesh_vaghela ,This is what the  "index | table _raw " looks like. I am not sure whats causing to be tmp to be not found in the query.     { "Info": { "Unit": "ABC", "Project": "XYZ", "Analysis Summary": { "DB1": { "Available": "1088kB", "Used": "173.23kB", "Used(%)": "15.92%", "Status": "OK" }, "DB2": { "Available": "4096kB", "Used": "1591.85kB", "Used(%)": "38.86%", "Status": "OK" }, "DB3": { "Available": "128kB", "Used": "0", "Used(%)": "2.6%", "Status": "OK" }, "DB4": { "Available": "16500kB", "Used": "6696.0", "Used(%)": "40.58%", "Status": "OK" }, "DB5": { "Available": "22000kB", "Used": "9800.0", "Used(%)": "44.55%", "Status": "OK" } }, "RAM_Tracking": { "a": "2", "b": "1088.0", "c": "32.1220703125", }, "Database2_info": { "a": "4", "b": "4096.0", "c": "654.3212890625", }, "Database3_info": { "a": "5", "b": "6696", "c": "9800", }, "Database4_info": { "a": "6", "b": "128.0", "c": "21.086", } } }                   ... View more

Hi @kamlesh_vaghela ,still it is the same. Actually my data is more, i have only written a few part of it in the question. if i use   | spath output=Analysis_Summary Info.Analysis_Summary | rex field=Analysis_Summary .....   will this be able to help? Below is my data.   { "Info": { "Unit": "ABC", "Project": "XYZ", "Analysis Summary": { "DB 1":{ "available": "1088kB", "used": "172.8kB", "used%": "15.88%", "status":"OK" }, "DB2 2": { "available": "4096KB", "used": "1582.07kB", "used%": "38.62%", "status":"OK" }, "DB3 3": { "available": "128KB", "used": "0", "used%": "0%", "status":"OK" }, "DB4 4": { "available": "16500KB", "used": "6696.0KB", "used%": "40.58%", "status":"OK" }, "DB5 5": { "available": "22000KB", "used": "9800.0KB", "used%": "44.55%", "status":"OK" } }, "Database1_info":{ }, "Database2_info":{ }, "Database3_info":{ } }}   Can you please help me. Not able to find out the mistake. ... View more

hi, @kamlesh_vaghela , still im getting as temp not found.. is it due to the new format of the data? is it becuase of new line? ... View more

Hi @kamlesh_vaghela , I have changed the file format to this, { "Info": { "Unit": "ABC", "Project": "XYZ", "Analysis Summary": { "DB 1":{ "available": "1088kB", "used": "172.8kB", "used%": "15.88%", "status":"OK" }, "DB2 2": { "available": "4096KB", "used": "1582.07kB", "used%": "38.62%", "status":"OK" }, "DB3 3": { "available": "128KB", "used": "0", "used%": "0%", "status":"OK" }, "DB4 4": { "available": "16500KB", "used": "6696.0KB", "used%": "40.58%", "status":"OK" }, "DB5 5": { "available": "22000KB", "used": "9800.0KB", "used%": "44.55%", "status":"OK" } } }} And Changed the query to | spath output=Analysis_Summary Info.Analysis_Summary | rex field=Analysis_Summary "\"(?<Database>[^\"]+)\":{ \"available\"\:\s\"(?<available>[^,]+)\",\"used\"\:\s\"(?<used>[^,]+)\",\"used%\"\:\s\"(?<used_p>[^,]+)\",\"status\"\:\"(?<status>[^}]+)\"}" max_match=0 | eval tmp = mvzip(mvzip(mvzip(mvzip(Database,available),used),used_p),status) | mvexpand tmp | eval Database=mvindex(split(tmp,","),0), available=mvindex(split(tmp,","),1), used=mvindex(split(tmp,","),2), used_p=mvindex(split(tmp,","),3), status=mvindex(split(tmp,","),4) | table Database available used used_p status But i am not able to collect the data.It says tmp does not exist.Is there any mistake in the regular expression? ... View more

Hi @bowesmana I got the time field like this. ... View more

hi @bowesmana ,Thank you so much, I tried, | bin _time span=1mon | stats count by _time user I am able to create a chart, but the span is not considered as 1 month, instead it is taking random spans and giving values. Is there any different way to specify span? ... View more

@bowesmanaThank you so much for the information. I will try to use that. Is there any method so that i can get monthly wise data apart from timechart? ... View more

Thank you so much.. It is working fine.. ... View more