About matiasburni

somesoni2 · ‎10-28-2015

Assuming you plan to run this search every hour, try something like this host="10.102.165.212" sourcetype=_json | spath| WHERE LIKE(master, "master") | stats latest('extra.memory') AS Current earliest('extra.memory') as LastHour | where Current>=LastHour*1.5

matiasburni · ‎08-14-2015

Thanks for your help, The final query is... I didin't know regex101.com, very useful !!! ^((.*)(eng\-builds\/)(?P[^\/]+))|(?:[^\/\n]*\/){2}(?P[^\-]+)

Posts	3
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎08-13-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to compare a json value field in a 1h window, ...

Editing RegExp on the "Extract Fields", what's "{2...

Re: How to compare a json value field in a 1h wind...

Re: Editing RegExp on the "Extract Fields", what's...