Thanks  Giuseppe.. I have to extract the docID field too. ... View more

must be missing our something in the syntax but if I just use the OR between two searches like below I am getting Error in 'search' command: Unable to parse the search: unbalanced parentheses. (<my search 1> OR <my search 2>)  I have provided the complete search command above in reply to Renjith. ... View more

Here is the updated Query which actual use of REX/EVAL/CASE/STATS in it: (index="myindex" "*upload succeeded" OR "*streaming succeeded" NOT "source" | rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size count | eval App="Upload-Manual") OR (index="myindex" "*upload succeeded" OR "*streaming succeeded" | rex "source=(?<App>[^,]+)." | rex "system=(?<App>[^,]+)." | eval App = case(App="FB","App1",App="TWTR","App2",App="Salesforce","App3",App="SAP","App3",App="Oracle","App3") | rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size Count by App) | table App Size Count | addcoltotals   I am getting following error -  Error in 'search' command: Unable to parse the search: unbalanced parentheses.   Thanks! ... View more

Thanks a lot, it worked! ... View more

Only command not working is - | replace "T" with " " in Time Still in the result I am seeing - 2021-09-11T11:01:19 ... View more

Yes,  anything thats after " interested in all events which contain the string". When I search with -   index="foo" | rex "(?<time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2},\d{3}).*\Problem creating batch from the downloaded mail with subject: (?<subject>.*)" then I am getting following error - Error in 'rex' command: Encountered the following error while compiling the regex '(?<time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2},\d{3}).*\Problem creating batch from the downloaded mail with subject: (?<subject>.*)': Regex: unknown property name after \P or \p.   But if I put a space between *\ and Problem, then it is providing all the rows, even without the even I am looking for and not in a tabular form. ... View more

Your suggestion of using multiple rex commands like below worked. | rex "source=(?<Source>[^,]+)." | rex "col1=(?<Col1>[^,]+)," | rex "col2=(?<Col2>[^,]+)," | rex "col3=(?<Col3>[^}]+)" Thanks! ... View more

Sorry Rich, here is the actual regex for the events mentioned above that I am using - rex " source=(?<Source>[^,]+).col1=(?<Col1>[^,]+).col2=(?<Col2>[^,]+).col3=(?<Col3>[^,]+)" ... View more

Hello Rich, here are some of the events - 2020-11-25 18:23:47,432 INFO [com.mycomp.docrepo.upload.FileUploadWebScript] [http-apr-8080-exec-3] The Upload Service /docrepo/service/comp/upload succeeded in 0.123000 seconds, Request: {col1=ab, col2=11252020_B1_DOC0_Fax_a4.HEIC, source=Fax, col3=application/octet-pdf} 2020-11-25 18:23:47,358 INFO [com.mycomp.docrepo.upload.FileUploadWebScript] [http-apr-8080-exec-2] The Upload Service /docrepo/service/comp/upload succeeded in 0.255000 seconds, Request: {col1=cc, col2=11252020_B2_DOC0_Scan_a5.HEIC, source=Scan, col3=application/octet-pdf} 2020-11-25 18:23:43,066 INFO [com.mycomp.docrepo.upload.FileUploadWebScript] [http-apr-8080-exec-4] The Upload Service /docrepo/service/comp/upload succeeded in 0.543000 seconds, Request: {col1=xy, col2=11252020_B3_DOC0_Email_a3.HEIC, source=Email, col3=application/octet-stream} 2020-11-25 18:23:42,789 INFO [com.mycompe.docrepo.upload.FileUploadWebScript] [http-apr-8080-exec-2] The Upload Service /docrepo/service/comp/upload succeeded in 0.262000 seconds, Request: {col1=pc, col2=11252020_B3_DOC0_Email_a2.HEIC, source=Email, col3=application/octet-stream} 2020-11-25 18:23:42,344 INFO [com.mycomp.docrepo.upload.FileUploadWebScript] [http-apr-8080-exec-8] The Upload Service /docrepo/service/comp/upload succeeded in 0.254000 seconds, Request: {col1=ab, col2=11252020_B3_DOC0_Email_a1.HEIC, source=Email, col3=application/octet-stream} 2020-11-25 16:04:19,342 INFO [com.mycomp.docrepo.upload.FileUploadWebScript] [http-apr-8080-exec-7] The Upload Service /docrepo/service/comp/upload succeeded in 0.569000 seconds, Request: {col1=xy, col2=11252020_B4_DOC0_Email_a2.MOV, source=Email, col3=application/octet-stream} ... View more

Thanks for your inputs. Checked the code again but sees fine unless I am missing anything - | rex " source=(?<Source>[^,]+).center=(?<center>[^,]+).accountNum=(?<accountNum>[^,]+).policyNum=(?<policyNum>[^,]+).clmNumber=(?<clmNumber>[^,]+).name=(?<name>[^,]+)"  if I say <source> then it provide the source file name but not the value in the logfile for "source". ... View more

Hello Rich, Using "Source" is giving me null value. Field value is empty. ... View more

Thanks a lot Rich. Can you confirm "FileName" in report will give me whats in Location 1stTestforme.pdf ( D:\testfolder\out\1stTestforme.pdf ) I updated the Query so that it gets only 0KB file and escape was not working so added two back slash. index=foo ("Query String:" OR "Upload Completed" AND "SIZE=0.0 KB" ) | rex "empNumber=(?<empNumber>\d+)" | rex "deptCode=(?<DeptCode>\d+)" | rex "source=(?<Source>[^,]+)" | rex "uploadedBy=(?<uploadedBy>[^&,]" | rex "name=(?<name>[^&,]+)" | rex "location=(?<location>[^&]+)" | replace "+" with " " in name | rex "\\\\(?<FileName>\w+\.?\w+$)" | stats values(*) as * by empNumber, Source, DeptCode, uploadedBy | table _time empNumber, Source, DeptCode, uploadedBy, FileName But what I am seeing is although the search works fine ans shows 12 events - Complete 12 events (7/15/20 11:44:00.000 AM to 7/15/20 3:44:32.000 PM) But I don't see any output in report. ... View more

secondly, there is another row in there which provides the Query String and it has info like - Query String: empNumber=12345&deptCode=6789&source=App1&contentType=letter&location=D:\testfolder\out\1stTestforme.pdf&name=1st+Test+For+Me&uploadedBy=User1&mimeTYpe=application%2Fpdf As you can see it has Location and Name. I need to get Location but in the Query I don't have response which shows 0KB. So, query first need to read - Upload Completed /Repo/service/ABC/upload succeeded Request: {empNumber=12345, name=1st Test For Me, uploadedBy=User1, DeptCode=6789, source=App1, mimeType=application/pdf}, Response: {MIMETYPE=application/pdf, SIZE=0.0 KB} [Last Line] Get all the reset set and then later search the above line (query string) to see what the value there is in the location. and bring it in the report. Query String also has "name" which has been replaced "space" by "+" in Query String. So, report should get info from these two rows.... ------ Upload Complete Line ------     -- Query String -- empNumber source DeptCode UoloadedBy      FileName 12345      App1   6789     User1         1stTestforme.pdf   Hope this new info helps. ... View more

Thanks Rich. Yes, there can be lot of lines but this upload goes in one set of batch. First line starts with  - ****** NEW WEBSCRIPT REQUEST ****** and Last line ends with - SIZE=0.0 KB}    ... View more