The field extraction works for nearly all events, except for events where the line count is over 450. The returned value of the extraction for such events are about 27 lines long or 2500+ characters long. The field extractions ends with the following pattern (regex for security): \w+?\s|\s\d{9} and the pattern that follows the extracted field is =(\w+?.){5}\w+. I am aware that I should probably do this extraction and search time, but I have been overruled on that matter. Here are some relevant configurations: PROPS: BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} \[ ADD_EXTRA_TIME_FIELDS = True ANNOTATE_PUNCT = true AUTO_KV_JSON = true BREAK_ONLY_BEFORE_DATE = true DEPTH_LIMIT = 1000 FIELD_HEADER_REGEX = \[* LEARN_MODEL = true LEARN_SOURCETYPE = true LINE_BREAKER_LOOKBEHIND = 100 MATCH_LIMIT = 100000 MAX_DAYS_AGO = 2000 MAX_DAYS_HENCE = 2 MAX_DIFF_SECS_AGO = 3600 MAX_DIFF_SECS_HENCE = 604800 MAX_EVENTS = 500 MAX_TIMESTAMP_LOOKAHEAD = 128 NO_BINARY_CHECK = true SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard SHOULD_LINEMERGE = true TRANSFORMS-sesh_vars = sesh_vars ### VARIOUS TRANSFORMS FIELD EXTRACTIONS HERE TRUNCATE = 50000 detect_trailing_nulls = false disabled = false maxDist = 100 category = Custom TRANSFORMS: [sesh_vars] REGEX = (?m)Session\s+(?<sesh_vars>(.+\s*)+?)(?=Additional|$) WRITE_META = true ... View more

I wish to hit "/controller/rest/applications/app-name/request-snapshots?time-range-type=BEFORE_NOW&duration-in-mins=60" but it doesn't seem to be working. I've tested with a REST client and it seems to work perfectly there, so I suspect that what I have in the parameter field isn't correct. There's no documentation on how to input the parameters into the proper fields when adding a new input. If anyone has a clue let me know. Thanks. ... View more

I am trying to run a transaction search off a data model as seen below: | datamodel WebLogs_Session_Test Checkout_Hits search | transaction Web_Page_Hits.user mvlist=t maxpause=30m maxspan=4h maxevents=100000 keepevicted=true | eval ckty=mvsort(Web_Page_Hits.Checkout_Hits.ckty) | chart list(ckty) by Web_Page_Hits.user list(ckty) doesn't return any values, however: | datamodel WebLogs_Session_Test2 Checkout_Hits search | transaction Web_Page_Hits.user mvlist=t maxpause=30m maxspan=4h maxevents=100000 keepevicted=true | chart list(Web_Page_Hits.Checkout_Hits.ckty) by Web_Page_Hits.user This returns a proper chart with a list of values next to each user, which looks something like this: USER1 1 0 0 1 0 USER2 0 0 0 0 0 1 What I would like to accomplish is to return whether or not the value "1" exists within the field for each user. Thanks. ... View more