About xvxt006

xvxt006 · ‎08-05-2014

Hi, we have uris in the below format. i want to capture only up to 2 levels (if it does not have 2 levels it should show what it has. for example xxxx in the first uri example) and i have used below rex expression but it still gets all the levels. Any help is appreciated rex field=uri_path "/(? .[/.])(?:[\s/]) /xxxx /xxxx/yyy /xxxx/yyy/zzzz/

xvxt006 · ‎07-31-2014

Hi, I would like to get stats by http status and also i would like to add percentage column. when i use top it gives by uri or some other field which i don't want. Right now output looks like this. But i need to add percentage. status count 200 557374 301 151 302 61 400 33 404 542 405 24 500 6541

xvxt006 · ‎07-25-2014

Thank you all. I think these are valuable suggestions.

xvxt006 · ‎07-25-2014

Thx. This worked

xvxt006 · ‎07-25-2014

Thx for the input. i have tried the other solution and it worked.

xvxt006 · ‎07-25-2014

Hi, i have an event like below after ms there is a line break and some other text. i want to capture that time. i have tried the below expression but it did not work. Any suggestions? INFO: Server will startup in 2131 ms sdfsfsdfsdfsff expression i have used: rex field=_raw "(?i) .? Server will startup in (?P . ?)(?=ms)"

xvxt006 · ‎07-25-2014

Hi, i would like to exclude certain time ranges over a period of time when i am doing a live search. Can i do that? For example i want to include only from 8 am to 5 pm. how can i do that?

xvxt006 · ‎07-24-2014

Hi, i have a dashboard and i want to get data for each environment. For example QA/Prod, etc. So i want to have a drop down in the form where user can select QA or Prod and accordingly it should execute corresponding query and populate results. is there any documentation or any suggestions on how to do this.

xvxt006 · ‎07-23-2014

Thank you. i did not know that having table would still show the chart

xvxt006 · ‎07-23-2014

yes you are right. But when i use timechart, i don't get the date format in the way i want (month-day) and also when i chart it, it skips showing some of the dates (even though data points are there)

xvxt006 · ‎07-23-2014

Hi, i am charting errors and i see that for some of the days there is no data and i want to fill that date with 0. So i have used this query. I see that i have 0s when there are no actual values. But in the chart, i see actual values on the x axis and date values as the data points. How to flip this so that i see date on the x axis and actual data on the data points.. | gentimes start=06/23/2014 end=07/23/2014 increment=1d | fields starttime | eval Date=strftime(starttime," %m-%d") | eval Errors= 0 | fields 404s,Date | join type=outer Date[search xxxxx | eval Date=strftime(_time," %m-%d") | chart count(uri) as Errors over Date | sort by Date]

xvxt006 · ‎07-23-2014

Actually we wanted as a screenshot instead of PDF

xvxt006 · ‎07-23-2014

Can we insert a screenshot of a dashboard in the alert? i want to include a screenshot of a dashboard in a report email

xvxt006 · ‎07-22-2014

Hi, We have few dashboards with more than 10 widgets and it takes lot of time to load these. is there a way to speed these up? i have tried accelerating the searches but not much of improvement. i don't know if acceleration is working or not. Any suggestions?

xvxt006 · ‎07-14-2014

never mind i have used column chart. Thanks for your help

xvxt006 · ‎07-14-2014

Thanks i got this. But the stacked bar chart is horizontal meaning bars are going in horizontal. Can i make them vertical?

xvxt006 · ‎07-14-2014

Hi, i have metrics that i want to track them as stacked over period of time (day) | chart over Date by measure This is not giving any results. Do you know why?

xvxt006 · ‎06-29-2014

Hi, we have data that i am getting report using addcols to combine the data and using transpose to get the data in the below format. if anyone wants the query that i am using, i can send it Measure value number of subscriptions today 10 number of subscriptions Lastweek 5 Delta in subscriptions % 100% Revenue today $ 100 Revenue Lastweek $ 50 Delta in Revenue 100% Requests today 200 Requests LastWeek 100 Delta in Requests 100% I want the data in the below format - Measure Today LastWeek Delta Subscriptions 10 5 100 Revenue $ 100 $ 50 100 Requests 200 100 100 How can this be done?

xvxt006 · ‎06-17-2014

Hi Thanks for checking. I have figured out this.

xvxt006 · ‎06-11-2014

Hi, I saw that there is dc so we can get the distinct count but what if I want to get the sum for unique field values? I have tried something like this but it is missing some values. Any suggestions? base search | dedup field | stats sum(field) as sum

xvxt006 · ‎06-06-2014

Thanks. This gives me before /ecatalog. I want the part which is after ecatalog.

xvxt006 · ‎06-06-2014

Hi we have some uri's as shown below which have 2 words (/verify/abrasives) before /ecatalog and 3 words and 4 words. I want to get the uri's only after /ecatalog /verify/abrasives/ecatalog/N-bi1/Ntt-3M+Abrasives /verify/bearings/power-transmission/ecatalog/N-aoj /verify/abrasive-cut-on/power-saws-and-accessories/power-tools/ecatalog/N-caiZ1z0d6at i have tried like this but it did not give me proper results. Any suggestions? Base search | rex field=uri_path ".*?(? [^(?:/ecatalog)]+)"

xvxt006 · ‎06-02-2014

One question some times it has no value in it. as shown below. i was expecting something like - in the captured values. if i want to capture that as well, can i do that? ?product=%20FILTERS%2016z20r2&account=&country=US HTTP/1.1" 200 3388 218391

xvxt006 · ‎06-02-2014

Thank you. It worked.

xvxt006 · ‎06-01-2014

Hi, i want to extract account field and i have events in 2 patterns. One where account has boundaries of @account= and right boundary as & as shown in event 1 2nd pattern is having @account as left boundary and left boundary as space Event1 pattern is working fine but Event2 gives the whole event after account= which is 123452 HTTP/1.1" 200 1216 109354 "-" "-" "-" What should i have just to have the account value from Event2 pattern Event1 ?product=%20FILTERS%2016z20r2&account=12334312&country=US HTTP/1.1" 200 3388 218391 "-" "-" "-" "-" "-" "-" "-" "-" "-" "-" " Event2 ?product=2CSY1&account=123452 HTTP/1.1" 200 1216 109354 "-" "-" "-" Expression used: (?i)&account=(?P [^&]+)(?:\s|[&].*)

Posts	246
Solutions	1
Karma Given	9
Karma Received	22
Member Since	‎09-25-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Grouping by name

To Get sum of hosts

How to find out if there are multiple hits to page...

How do I edit my rex mode=sed syntax to replace pa...

How can we get host names for given IPs in a searc...

Regex to capture values

How to show 2 results within the same alert?

Getting the counts

Why am I not seeing any values for fields created ...

Can we add specific text in Alerts

rex for capturing up to 2 levels

How to get percentage from stats count on http sta...

Re: How to speed up the dashboards

Re: Help with rex expression to capture time

Re: Help with rex expression to capture time

Help with rex expression to capture time

Can we specify cron schedule in the live search

How to dynamically select a search from dropdown

Re: chart with missing values

Re: chart with missing values

chart with missing values

Re: Can we insert a screenshot of a dashboard in t...

Can we insert a screenshot of a dashboard in the a...

How to speed up the dashboards

Re: chart over date for metrics

Re: chart over date for metrics

chart over date for metrics

How to change the format of my data?

Re: How to get sum for unique field values?

How to get sum for unique field values?

Re: Regular expression for a pattern

Regular expression for a pattern

Re: Regex for extraction

Re: Regex for extraction

Regex for extraction

Join the Conversation