Correct, should split the transaction and fit into the hour it belongs in. So 1m4s into 13th hour, 0m23s into 14th hour. ... View more

You're correct that there is an assumption that at least one rig/host reported in the current period. As long as that is true, then current would be populated for all rigs. If it is possible that no rigs reported in the current period (and there isn't a different alert for that...), then we can alter the where clause slightly and cover this case as well: | where last>0 AND (isnull(current) OR current=0) ... View more

@cmisztur, I have updated my answer. See if it fits your needs. ... View more

when you tried xpath, what did you try? |xpath outfield=one "//msg:XYS/msg:ONE" ... View more

You need sort 0 - _time or you will be dropping events. ... View more

+1 for the Syslog note. Let me try the line break and see if that is the cause. I have created a custom source_type and set the event break regex there. I hope that's the same as BREAK_ONLY_BEFORE. ... View more