Another solution is to group by range, e.g: search | chart count by duration span=5 ... View more

Hi, I needed do get the last "etapa" from some transactions indexed by "pedido", so I did a "streamstats count", prefix "etapa" with "count". This way I could bypass alphabetic ordination. After it, I remove the prefix "1|", "2|", "3|" ... it using a temp variable named "etapa2" and regex. This workaround solve it for me: search... | streamstats count | eval count=substr("0000000".tostring(count), -5) | eval etapa=count."|".etapa | transaction pedido startswith="*status\=\"iniciado\"" mvlist=pedido | rex field=etapa "^\d+\|(?<etapa2>.*)$" | eval etapa=etapa2 | eval l_etapa = mvindex(etapa,0) | .... I hope this can help you. Edited: I add this line to fix errors on alphabetic ordination. Ex: "10 < 2". Now we got "10 > 02" | eval count=substr("0000000".tostring(count), -5) ... View more

The full search command answer for me was: index="my_app" p_id=* | transaction p_id mvlist=status ... View more

Thanks! It works after some adaptations. PS: There is an error at variable enddtime1, the correct should be endtime1 The final code for my environment was something like this: One observation: Because I'm using minutes to count the total SLA, the regular expression used to validate from 08 to 18 should stop as 17, because 17 means 17:00, 17:01 ....17:59. index="my_app" p_id=635392908992408562 | transaction p_id | eval starttime=_time | eval endtime=_time+duration | eval my_minutes=mvrange(starttime,endtime,60) | convert ctime(my_minutes) timeformat="%Y-%m-%d %H:%M:%S" | eval interestedMinutes=mvfilter(match(my_minutes,"( 08| 09| 10| 11| 12| 13| 14| 15| 16| 17).*")) | eval SLA_Minutes=mvcount(interestedMinutes) | eval SLA_Time=tostring(SLA_Minutes*60,"duration") | eval h_starttime=strftime(starttime,"%Y-%m-%d %H:%M:%S") | eval h_endtime=if(duration!=0, strftime(starttime+duration,"%Y-%m-%d %H:%M:%S"), "") | eval h_duration=if(duration!=0, tostring(duration,"duration"), "") | table p_id h_starttime h_endtime SLA_Time ... View more

1) starttime 2017-05-14 14:00:00 and endtime 2017-05-16 10:41:28 The result should be 18:41:28. On detail the calculation will be like below: D14 - 14:00:00 to 18:00:00 = 04:00:00 D15 - 06:00:00 to 18:00:00 = 12:00:00 D16 - 06:00:00 to 10:41:28 = 02:41:28 SLA = 04h + 12h + 02:41:28 = 18:41:28 2) Every starttime or endtime will be consider to the next valid time. e.g: 19:00 will be consider next day at 08:00 06:00 will be consider current day at 08:00 ... View more

starttime 2017-05-15 14:00:00 and endtime 2017-05-16 10:41:28 The result should be 06:41:28. ... View more

Try this one: index="web_app" | top app_user | transpose column_name="First Column Name" header_field=app_user include_empty=false ... View more

The following search filter all http status 2xx, 4xx and 5xx and create a field to with the percentage of http status 200 comparing with errors 400 and 500. If status 200 is lower than 94%, an "Warning" is applied. base search | rename message.status as msg_status, message.fwdHost as hhost | search msg_status=2* OR msg_status=4* OR msg_status=5* | rangemap field=msg_status "200 Sucesso"=200-299 default="400-599 Erros" | eval ok=if((range = "200 Sucesso"), 1, 0) | eval nok=if((range = "400-599 Erros"), 1, 0) | stats sum(ok) as ok sum(nok) as nok by hhost | addtotals | eval p_ok=ok/Total*100 | rangemap field=p_ok "Normal"=94-100 default="Warning" The result was like this: hhost;ok;nok;p_ok;range;Total cgws.domain.com;2055;102;95.271210;Normal;2157 dn.domain.com;6;1;85.714286;Warning;7 ecommerce.domain.com;106115;646;99.394910;Normal;106761 ... View more

Another way is: <your_base_search> | bucket _time span=1h | top 10 categories by _time ... View more

You won't get false results because head will limit only the lastest events (even if there no results on desired range). You want 8 to 9? So search 1 to 9, or past 24h and use head to take only the last events based on your span. ... View more

I know index=* is waste of processing. Was just an example. My suggestion is most useful If you have regular events and don't care to wait some more seconds on your query. ... View more

Another way to avoid no result on timechart is to search a big range and limit result is using “sort -_time | head n”. Example: index="*" | timechart count(dst) as Destinations span=10m | sort -_time | head 6 If you need to get the timechart of the past hour, we can search the hole day (or another time that we know that is at least one event), and them limit using head. In this case the "head 6" is the same of 60 minutes, because our span is 10 minutes. ... View more

Nice! I was searching for this a long long time. If you try to simulate this on "Search" it won't work. This feature works only on views/dashboards. For understand this berravior I test it using the following generic search: <single> <title>Network Monitoring - Jabber</title> <option name="classField">range</option> <option name="field">status</option> <searchString>index=* | head 1 | eval status="up" | head 1 | eval alert_level = case(status=="up",1,status=="down",2) | rangemap field=alert_level low=1-1 severe=2-2 </searchString> </single> ... View more

You can use some others configurations to make it bigger like: .results-table .wrapped-results th, .results-table .wrapped-results td { font-size: 25px; height: 25px; vertical-align: middle; ... View more

If you add "admin_all_objects" on Role Capabilities the gauge works fine. I don't think this is the best solution, but works. ... View more