About muthvin

muthvin · ‎03-18-2016

I want a query to create a table with time stamp as column A Products as column B and Services as Column C....then ColumnB (Products) should have 3 sub-column product A, B, c resp...like we use to have in Excel.

muthvin · ‎03-17-2016

Yes its just a sample data... _time Products Services ProductA Product B Product C ServiceA Service B Service C

muthvin · ‎03-17-2016

Hi, Please help me in creating a table with timechart grouped by columns: _time Products Service ProductA ProductB ProductC ServiceD ServiceE ServiceF xxxx assaaa assaaa assaaa assaaa assaaa assaaa xxxx assaaa assaaa assaaa assaaa assaaa assaaa xxxx assaaa assaaa assaaa assaaa assaaa assaaa xxxx assaaa assaaa assaaa assaaa assaaa assaaa xxxx assaaa assaaa assaaa assaaa assaaa assaaa xxxx assaaa assaaa assaaa assaaa assaaa assaaa

muthvin · ‎01-16-2016

Hi, I need a regex which will fetch the last value of log events ends with [abcd]. Currently the challenge i'm facing here is my log events. Here the sample log has 2 lines , next will have 4 lines, next 10 lines and so on... I need a robust regex which will fetch the last value here the value is 4. My initial regex : ^(?:[^[\n]*[){4}(?P<test>[^]]+) Sample log event : 2016-01-13 05:39:12.413Z [Rabbit listener thread] [finance] INFO [c.t.events.EventDemultiplexer] finance event demultiplexer completed event processing [LB-g6yp6980-j4as-w1sc-nhc4-n9gnryla8s7o] Kindly help!

muthvin · ‎01-15-2016

Thanks guys in my case i reverted module by sourcetype and that solves my problem..

muthvin · ‎01-15-2016

HI all I have two search which yield the table like this below: Module1 Module2 Name1 1.2 2.2 Name2 1.5 3.2 Name3 1.6 4.2 Name4 1.2 5.2 Name5 1.5 6.2 Name6 1.6 7.2 My queries are like: index=_internal module="module1" | stats count by sourcetype and index=_internal module="module2" | stats count by sourcetype I want to merge these queries and create a dashboard panel to yield results as in table and line graph with two lines in it. It will be great if someone help me here! Thanks.

muthvin · ‎01-11-2016

will you be able to explain me why we need to use mvindex here after assigning values(field3) as field3 ?

muthvin · ‎01-11-2016

what i'm trying to do here is: step1: i will check for field1 value..if it is orange step2: fetch the corresponding value in field2..here the value is 10 step3: Assign this value to abc..such that abc=10 step4: eval new field pass =field2-abc..if it is equal to zero then value =abc else step5: eval new field fail - gives the difference and provide me the difference.

muthvin · ‎01-11-2016

yes i did Ranjith, but unfortunately im getting result for only one row not for all rows..Actually i'm struck here.. field1 field2 field3 pass fail Orange 10 10 10 0 apple 9 10 potato 7 10 How to make this calculations happen to all rows?

muthvin · ‎01-11-2016

Pass = field3-field2 fail = field2-field3

muthvin · ‎01-10-2016

After declaring the variable will you be able to use Os_Type in calculating other fieldvalues?

muthvin · ‎01-10-2016

hi all, With your previous suggestion i can able to create a parameter like in field3,but i want field pass and fail should get calculated like below. Need your help! field1 field2 field3 pass fail Orange 10 10 10 0 apple 9 10 9 1 potato 7 10 7 3

muthvin · ‎01-10-2016

yes it is working for me..thx

muthvin · ‎01-08-2016

Hi, also here if i want to save the value of field2 corresponding to filed1 value orange say here is 10 as another variable abc..how can i do that?

muthvin · ‎01-07-2016

thanks for your reply: Here im trying to create another field3 as per your suggestion im getting output like field1 field2 field3 Orange 10 10 apple 12 12 potato 13 13 but i would like to have result as below: field1 field2 field3 Orange 10 10 apple 12 10 potato 13 10

muthvin · ‎01-07-2016

Hi all, How do I write an eval statement to fetch the value of field2 corresponding to field1? For example, consider the table below: field1 field2 Orange 10 apple 12 potato 13 If field1 value is orange, I want to assign a value of abc as corresponding field2 ..here it is 10 ..|eval abc= value of field2 for orange.. Kindly help me in writing the search. Thanks in advance Muthu

muthvin · ‎12-29-2015

thx for your reply jmallorquin, but i need more clarity on your suggestion . Also i tried |eval field=rtrim(yourfield,"****") which helped me. It will be great if you help me in understanding your view mentioned above. Muthu

muthvin · ‎12-28-2015

how to remove last character of a field value from the search results

Posts	18
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎12-28-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

how to have a timechart table group by columns

Required robust regex to fetch the last value of t...

How to show two search results in one dashboard pa...

How to write an eval search to fetch the value of ...

how to remove last character of a field value fro...

Re: how to have a timechart table group by columns

Re: how to have a timechart table group by columns

how to have a timechart table group by columns

Required robust regex to fetch the last value of t...

Re: How to show two search results in one dashboar...

How to show two search results in one dashboard pa...

Re: How to write an eval search to fetch the value...

Re: How to write an eval search to fetch the value...

Re: How to write an eval search to fetch the value...

Re: How to write an eval search to fetch the value...

Re: declare a variable in search string

Re: How to write an eval search to fetch the value...

Re: How to write an eval search to fetch the value...

Re: How to write an eval search to fetch the value...

Re: How to write an eval search to fetch the value...

How to write an eval search to fetch the value of ...

Re: how to remove last character of a field value ...

how to remove last character of a field value fro...