I'm trying to chart the count of how many different methods are detected during a specific search. The methods are in different fields so I am using makemv and delim to create one field called "method". When I do chart or stats count by method I get a pie chart that contains equal sections. I need to have the actual count of each method instead. What am I missing? basic search | transaction UID | rename fieldA as Create, fieldB as Close, fieldC as Update, fieldD as PostClose, fieldE as Reopen |eval method="Create,Close,Update,PostClose,Reopen" | makemv method delim=","| mvexpand method | chart count by method ... View more

I am attempting to set a value using a token but it's only recognizing the 2nd option. This is the part that seems to be broken. 1) <label>Method</label> 2) <choice value="text">Title</choice> 3) <choice value="moretext">Another Title</choice> 4) <change> 5) <condition label="Title"> 6) <set token="timeout">"5"</set> 7) </condition> 8) <condition label="Another Title"> 9) <set token="timeout">"120"</set> 10) </condition> 11) </change> 12) <query>index=$ENVPicker$ sourcetype=$sourcetype$ | transaction UID | chart count by duration span=$timeout$</query> 13) <earliest>$TRPicker.earliest$</earliest> 14) <latest>$TRPicker.latest$</latest> 15) </search> All tokens are working except for $timeout$. It's only populating with 120 instead of any other value no matter which condition is met. I've tried using different settings such as: What am I missing? ... View more

I am trying to create a dashboard panel that shows errors received. I am using a field alias to rename three fields to "error" to show all instances of errors received. Due to the nature of the log I could not get my field extraction to work on all errors in one pass, hence the use of field alias. My "error" column is not displaying all results. I have tried using "fields" to pass over the required data but nothing is working. This is my search: index=myindex sourcetype=mysourcetype error | fields _time,xxx_xxxx_xxx,call_error,conID_not_found,val_error,error | table _time xxx_xxxx_xxx error And this is the result I get: _time XXX_XXXX_XXX error 2017-10-25T11:25:53.978-0400 xxxxxxxxxxxxxxxxxxx getUser Account web service: 2017-10-25T09:35:31.794-0400 xxxxxxxxxxxxxxxxxxx getUser Account web service: 2017-10-18T22:13:18.870-0400 xxxxxxxxxxxxxxxxxxx Missing "Jurisdiction" parameter 2017-10-18T21:57:11.458-0400 xxxxxxxxxxxxxxxxxxx 2017-10-18T21:57:02.833-0400 xxxxxxxxxxxxxxxxxxx 2017-10-18T21:56:52.036-0400 xxxxxxxxxxxxxxxxxxx 2017-10-18T21:55:35.535-0400 xxxxxxxxxxxxxxxxxxx 2017-10-18T13:38:03.157-0400 xxxxxxxxxxxxxxxxxxx Missing "Request Received Date" parameter 2017-10-18T12:24:24.826-0400 xxxxxxxxxxxxxxxxxxx Missing "Request Received Date" parameter 2017-10-18T05:25:05.793-0400 xxxxxxxxxxxxxxxxxxx Missing "Jurisdiction" parameter 2017-10-18T05:01:58.696-0400 xxxxxxxxxxxxxxxxxxx 2017-10-18T05:00:57.618-0400 xxxxxxxxxxxxxxxxxxx 2017-10-18T05:00:04.759-0400 xxxxxxxxxxxxxxxxxxx 2017-10-17T10:29:31.938-0400 xxxxxxxxxxxxxxxxxxx Missing "Request Received Date" parameter 2017-10-16T13:06:25.353-0400 xxxxxxxxxxxxxxxxxxx "Contract Number" has exceeded its character length of "50" Why am I missing results in the error column. They exist in the events panel. ... View more

I have a list of files similar to this list: FileObjMgr_01235_567.log EIM_0080123_45.log EIM_01031234_56.log EIM_01272345_67.log FINSObjMgr_56789_1234.log File3Svc.log SCFile_123456_1345.log SRFile_5794_5879.log ServerMgr_54525852_452.log SvrTaskPersist_857494_58674.log WfProcBatch_748490_5857.log WfProcMgr_2971_9928.log XMLPReporter_8751_35485.log I am trying to extract the first part of the file name up to the "" character. Some files do not have an "" so I need the name up to .log. So far I've only been able to successfully pull names using this: index= sourcetype=:* | rex field=source "./(?[A-Z]\w\w\w\w\w\w\w)..log" | inputlookup append=T filetypes_prod.csv| stats count by filetype | eval Status=if(count<2, "Missing", "OK") | sort filetype| outputlookup filetypes_prod.csv However I am getting too many characters as below. How to I extract just to the "_" and, if that is not present to .log? EAIObjMg EIM_0080 EIM_0103 EIM_0127 EIM_0151 EIM_0171 EIM_0191 EIM_0223 FINSObjM MASL3Svc SCBroker SRBroker ServerMg SvrTaskP WfProcBa WfProcMg XMLPRepo ... View more

My events have the following timestamp at the beginning of each line: [2016-05-18T18:41:51.440-04:00] In props.conf, I set the following but it is not working: NO_BINARY_CHECK=true disabled=false TIME_PREFIX=^[ TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N TZ=America/New_York Any ideas on why this is not working? ... View more