"ContactId":"12345" and i have tried rex "\"ContactId\":\"(?[0-9]*)\"" and no result.. please help.. what did i do wrong with escape char \? ... View more

index=xyz CurrentAgentSnapshot.Contacts{}.State=ENDED | table CurrentAgentSnapshot.Contacts{}.StartTime There is no issue with this. but it gives me error when i try to do eval x = CurrentAgentSnapshot.Contacts{}.StartTime (the error is Error in 'eval' command: The expression is malformed.) I need to do some calculation using eval on some of the variables CurrentAgentSnapshot.Contacts{}.variables .. such as eval startTime = strptime(CurrentAgentSnapshot.Contacts{}.StartTime, "%Y-%m-%dT%H:%M:%S.%3N") | eval endTime = strptime(CurrentAgentSnapshot.Contacts{}.EndTime, "%Y-%m-%dT%H:%M:%S.%3N") | eval diff = tostring((endTime - startTime), "duration") ... View more