Hello, I am trying to extract several lines of text using regex and whilst I can extract up to the first carriage return I cannot work out how to extract the subsequent line The below is the text I am attempting to extract [29/07/17 23:33:22:707 EST] 0000003e SystemOut O 23:33:22.707 [WebContainer : 4] ERROR c.a.r.l.controller.NotifyController - OOps javax.xml.ws.soap.SOAPFaultException: Failed to process response headers And the regex I am using is rex "[.*?(?P [^\r\n]+)" The output using the above is [29/07/17 23:33:22:707 EST] 0000003e SystemOut O 23:33:22.707 [WebContainer : 4] ERROR c.a.r.l.controller.NotifyController - OOps How can I expand the above regex to capture the second line (javax.xml.ws.soap.SOAPFaultException: Failed to process response headers) ? Help will be greatly appreciated. Cheers, Alastair ... View more

I am slowly going insane trying to figure out how to remove duplicates from an eval statement. where acc="Inc" AND Stage = "NewBusiness" | stats dc(quoteNumber) AS Quotes count(eval(processStatus="ManualRatingRequired")) as Referrals |eval perc=round(Referrals/Quotes*100, 1)."%" The problem I am having is that whilst I have been able to remove the duplicates for the first stats (Quotes) I am unable to remove them for the eval component. If I use distinct count then only 1 even is returned and if i use distinct count with a filter by quoteNumber then all works and the duplicates are removed... however the results are returned as separate events in table format. I am after distinct count of all quotes / a distinct count of all quotes that have a processStatus of Referred. Sounds easy (and it probably is) but it is doing my head in and I am not getting any closer to a solution.... so for the sake of my sanity any help will be great appreciated. Cheers, Alastair ... View more

Hello, I am trying to use the stats command with 2 different where clauses with the end result being to use the 2 values to provide the total of scenario 1 displayed as a number and a percentage of scenario 2. For example I have a total of 50 referrals (where clause 1) and a total of 100 quotes (where clause 2). The table would display 50 in one column and 50% in the other (reflecting half of the total quotes were referred. My stats component of the search is ...| where acc="Inc" AND Stage = "Quote" AND processStatus="ManualRatingRequired" | stats count AS "Referrals" | appendcols [where acc="Inc" AND Stage = "Quote" | stats count AS tQuotes] The first part is working and returns the expected number but the second (appendcols) returns 0. If I switch it around then the first part returns the expected total, but not the number of referrals. I have tried various methods, but none seem to be achieving what I am trying to achieve. Any pointers will be greatly appreciated and will go along way to saving my sanity. Cheers, Alastair ... View more

Hello, I am trying to pass a static value to another form but not having much luck <drilldown target="My New Window"> <link> <![CDATA[quotes_by_broker?form.token_range=$totalQuotes>=1 AND totalQuotes<=20$&earliest=$earliest$&latest=$latest$ ]]> </link> </drilldown> The drilldown is called when a user clicks on a value and should load a form (which it does) and populate the token_range field which in turn is then used in a search. The reason I am trying to pass a static value is that source dashboard displays results as a single value and I would like to then display the breakdown to the user in the linked dashboard. The problem I have is that the new dashboard / form loads but the value populated into the token_range field is $totalQuotes> and nothing else. I have tried adding $$ to the value but no joy. Open to suggestions and any help is greatly appreciated. Cheers, Alastair ... View more