I want to merge values with similar string context and still be able to reverse search for those logs. Similar to this The stats count look something like this error count invalid input 25 price "1.24" does not match "1.21" 1 price "1.00" does not match "1.01" 1 price "1.34" does not match "3.21" 1 external services 15 I want it to look something like error count invalid input 25 price * does not match * 3 external services 15 When say I want to find the logs matches "price __ does not match __ " I can see the list of specific logs combined ... View more

I have a field in my logs that contains an array of string elements. Is there a way to detect for repeating strings and parse it differently within the search query for a dashboard? array = ["string1", "string2","string1"] regardless of however many repetition into array = "extra(string1), string2" ... View more

<fin:Data namespace=\"url1\" type=\"EData\">... Using basic search | rex "Data\snamespace=\"(?P<preName>[^\"]+)\"" | stats count by preName is empty Error here basic search | rex "Data\snamespace=\\\"(?P<preName>[^\\]+)\\\"" | stats count by preName I am not sure what's wrong, no results found. I am trying to get url1 using the regex above, but it's not matching? I am trying to see the list of values for that particular tag ... View more

I had a field of this value nameSpaces = ["url1"] nameSpaces = ["url1", "url2"] I got rex to change ["url1", "url2"] into "url1, url2" However, I am trying to change url1 to a label1, and url2 to label2, is there a way I can change it so the outcome from "url1, url2" to "label1, label2" ... View more