I've tagged my host field with their respective customer. I want to display the host as well as the tagged value in a Results Table. Either host can be displayed or it's tag but not both. This is what I am shooting for: host customer data host1 c1 123 host2 c1 345 Both fields show up in the Events Viewer and Events Table but not Results Table. ... View more

I have a SimpleResultsTable configured for drilldown which dispatches several child searches that display some charts. I want the child searches to set the latest time as the event time for what was clicked and I want the earliest time to be 1 day before that event time. For example, if you click on an event that occurred at 11/5/2011 12:30:00 I want the child searches to show events from 11/4/2011 12:30:00 to 11/5/2011 12:30:00. Is it possible to do this with earliest and latest and intentions? ... View more

I have 3 single rangemap fields configured in a dashboard. All 3 field values are actually 0. However, one of the values (for delete) is always shown as 'low' instead of '0'. Here is the search to verify values: sourcetype=rfsctl-a* earliest=-24h | rex field=_raw "megastore.stats.decode_errors: (? \d+)" | rex field=_raw "megastore.stats.delete_errors: (? \d+)" | stats avg(decode_errors) as avg_decode_errors avg(delete_errors) as avg_delete_errors | eval display_value_delete = tostring(round(avg_delete_errors,0), "commas") | eval display_value_decode = tostring(round(avg_decode_errors,0), "commas") --> with results avg_decode_errors avg_delete_errors display_value_decode display_value_delete 0.000000 0.000000 0 0 display_value_delete shows as 'low' in the UI Here is the xml: sourcetype=rfsctl-a* earliest=-24h | rex field=_raw "megastore.stats.encode_errors: (?<encode_errors>\d+)" | stats avg(encode_errors) as avg_encode_errors | eval display_value_encode = tostring(round(avg_encode_errors,0), "commas")| rangemap field=display_value_encode low=0-1 elevated=2-10 severe=11-1000 default=low Encode Errors range sourcetype=rfsctl-a* earliest=-24h | rex field=_raw "megastore.stats.decode_errors: (?<decode_errors>\d+)" | stats avg(decode_errors) as avg_decode_errors | eval display_value_decode = tostring(round(avg_decode_errors,0), "commas") | rangemap field=display_value_decode severe=11-1000 elevated=2-10 low=0-1 default=low Decode Errors range sourcetype=rfsctl-a* earliest=-24h | rex field=_raw "megastore.stats.delete_errors: (?<delete_errors>\d+)" | stats avg(delete_errors) as avg_delete_errors | eval display_value_delete = tostring(round(avg_delete_errors,0), "commas") | rangemap field=display_value_delete severe=11-1000 elevated=2-10 low=0-1 default=low Delete Errors range ... View more

I have some data that looks like: TIMESTAMP: 2011-10-31 13:51:25 top - 13:51:25 up 6 days, 19:53, 5 users, load average: 21.00, 20.57, 19.83 Tasks: 130 total, 0 running, 130 sleeping, 0 stopped, 0 zombie Cpu(s): 1.5% us, 0.7% sy, 0.0% ni, 96.4% id, 1.3% wa, 0.0% hi, 0.1% si Mem: 32906264k total, 32847544k used, 58720k free, 346852k buffers Swap: 33615352k total, 6804k used, 33608548k free, 7764416k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 25772 admin 17 0 22.8g 22g 7040 S 19.9 72.1 10:17.11 rfsd 25780 admin 16 0 22.8g 22g 7040 S 19.9 72.1 10:18.01 rfsd 25777 admin 16 0 22.8g 22g 7040 S 17.9 72.1 10:18.10 rfsd 25459 admin 16 0 22.8g 22g 7040 S 11.9 72.1 8:40.27 rfsd 25493 admin 16 0 22.8g 22g 7040 S 6.0 72.1 2:03.05 rfsd TIMESTAMP: 2011-10-31 13:52:25 top - 13:52:25 up 6 days, 19:53, 5 users, load average: 21.00, 20.57, 19.83 Tasks: 130 total, 0 running, 130 sleeping, 0 stopped, 0 zombie Cpu(s): 1.5% us, 0.7% sy, 0.0% ni, 96.4% id, 1.3% wa, 0.0% hi, 0.1% si Mem: 32906264k total, 32847544k used, 58720k free, 346852k buffers Swap: 33615352k total, 6804k used, 33608548k free, 7764416k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 25772 admin 17 0 22.8g 22g 7040 S 19.9 72.1 10:17.11 rfsd 25780 admin 16 0 22.8g 22g 7040 S 19.9 72.1 10:18.01 rfsd 25777 admin 16 0 22.8g 22g 7040 S 17.9 72.1 10:18.10 rfsd 25459 admin 16 0 22.8g 22g 7040 S 11.9 72.1 8:40.27 rfsd 25493 admin 16 0 22.8g 22g 7040 S 6.0 72.1 2:03.05 rfsd I want to line break only before "TIMESTAMP". Here is my props.conf: [source::/var/log/stats/rfsd_top*] SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = TIMESTAMP MAX_EVENTS = 400 I sometimes get an event with just the "TIMESTAMP.." line while other times I get the correct event intact. The event size is 132 lines. How can I get this to work? ... View more