Hi all, I want to extract fields form log events. I have two errors patterns : EDICPP 4-1-1-0 exception: Mandatory element is missing. Error at <src/CBRSegmentDecoders.cpp:21405 Error in segment CSC 06 1 1A TKA in element #2. ------ Error at <src/CBRMessageDecoders.cpp:121 Error in group Group id: _294728_G_CBR in element #3. ------ Decoding error in message AIRRQT 15 2 1A PNR in element #4 at character 240 of the buffer, using charset B Converted segments: ORG - BLK - AMD - AVC - BIN - Cannot convert CSC from here==>+9998WSSU'Last segment correctly processed: CSC+7906:/++9998WSSU' and Can't find the UNH segment. What i want is to create a field named grammar_error_reason that contain exactly "Can not convert FOO" or "Can't find the FOO segment". Here is my rex command : (Converted segments:(\s\w{3}+\s-)+\s|)(?<grammar_error_reason>.+) (from here|segment\.) Can you help me please. Kind regards, Clement ... View more

Hi all, I have two date fields extracted (with regex) from log files. starting_collection_timestamp = Thu Oct 17 22:40:10 GMT 2019 end_collection_timestamp = Thu Oct 17 22:40:21 GMT 2019 I tried to know the exact type for this fields with the command : | makeresults | eval t=typeof(starting_collection_timestamp) Here is the result : _time | t 2019-11-29 08:56:43 Invalid When i tried to calculate the elapsed time between starting_collection_timestamp and end_collection_timestamp i have an empty field. I tried to change the type with the command strptime without sucess. | eval strptime('starting_collection_timestamp', "%a %b %d %H:%M:%S %Z %Y") Thank you for your help. ... View more

Hi all, I have extracted a field (exit_status) in log file. I want to know if a process exit properly. I have 3 use cases that can be found in log files, exit_status = normaly, exit_status= -1 or exit_status not exist. I want to have a visualisation wich count the number of exit_status = normaly and the number of file that not exit normaly ( exit_status = -1 + exit_status do not exist) I don't know how to create a counter of existing value (-1) plus the number of file where exit_status do not exist. ... View more