| rex "Value = (?<json>\{.*\})" | spath input=json items{} output=items | mvexpand items | spath input=items ... View more

Hi @rohanmiskin, you could try something like this: index=your_index [ search index=your_index "string_to_search" | head 1 | eval earliest=_time, latest=relative_time(_time,"+5m") | fields earliest latest ] | ... in this way, using the subsearch, you identify the timestamp of the event to search and you display all the events from that time stamp for the following 5 minutes. Ciao. Giuseppe ... View more

@isoutamo Thanks. As you suggested, I just replicated the transform definition of my fields into prod env, via GUI ... View more

May or may not be. ... View more

Yup, this works perfectly. Thank you. ... View more

Hi @rohanmiskin Try this and let me know | makeresults | eval sampledata ="127.0.0.1|> GET /somedata" | rex field="sampledata" ">\s(?P<method>.*)\s\/" ... View more

Great to hear. ... View more