You are the man. Thank you for all your help. ... View more

Unfortunately, the strings I'm concerned about appear in different places in each event ... View more

2017-03-02 15:14:55,923 ERROR [ScheduleJobThread-1] ManagedEndpointsListener - Start [ManagedEndpointListener.addReference] [0] Start [HttpClientTransport.accept()] [1] issueHttpRequest [GET][https://pmruntime-lab.svc.ny.gov:443/rest/services/uddi:f8d50d0b-3143-11e5-8ec9-9133ad19fc08/wsdl?IncludeSoaExts=true&IncludeDependentObjects=true&IncludePolicy=true&WSDL_Customization_Scope=Private&PolicyVisibility=all&IncludePKI=true&EndpointsFromContainer=E-ND2&IncludeEndpoints=DerivedFromContainer][HTTP/1.1] [1] Message does not have transport security subject associated with it [206] Request [GET https://pmruntime-lab.svc.ny.gov:443/rest/services/uddi:f8d50d0b-3143-11e5-8ec9-9133ad19fc08/wsdl?IncludeSoaExts=true&IncludeDependentObjects=true&IncludePolicy=true&WSDL_Customization_Scope=Private&PolicyVisibility=all&IncludePKI=true&EndpointsFromContainer=E-ND2&IncludeEndpoints=DerivedFromContainer HTTP/1.1] completed in [205] mS, status [HTTP/1.1 200 OK] [206] End [HttpClientTransport.accept()] [209] Releasing client connection [https://pmruntime-lab.svc.ny.gov:443/rest/services/uddi:f8d50d0b-3143-11e5-8ec9-9133ad19fc08/wsdl?IncludeSoaExts=true&IncludeDependentObjects=true&IncludePolicy=true&WSDL_Customization_Scope=Private&PolicyVisibility=all&IncludePKI=true&EndpointsFromContainer=E-ND2&IncludeEndpoints=DerivedFromContainer] [210] Updating WSDL reference [/rest/services/uddi:f8d50d0b-3143-11e5-8ec9-9133ad19fc08/wsdl] [210] Sending add notification to [com.soa.mp.dos.ServiceMapper@47bef41c] [210] ServiceMapper.registrationAdded() [210] No key found in WSDL for service {http://service.virusscan.soa.coe.its.ny.gov}VirusScan1.0, DoS rules will not be found [210] Sending add notification to [com.soa.process.bpel.configuration.VSCapabilityConfigurationListener@48ce5035] [210] VSCapabilityCOnfigurationListener.registrationAdded(/rest/services/uddi:f8d50d0b-3143-11e5-8ec9-9133ad19fc08/wsdl) [210] {http://service.virusscan.soa.coe.its.ny.gov}VirusScan1.0 was registered with VS engine but no VS config found [210] Sending add notification to [com.soa.service.identity.runtime.ServiceSubjectMasterBuilder@41be673f] [233] Sending add notification to [com.soa.jbi.component.wsf.WSFSE@2656eed0] [234] End [ManagedEndpointListener.addReference] ... View more

Making progress. The search produces a table with counts for the frequency of each literal string, but the search itself does not seem to produce the errorMsg field itself when searching in Verbose mode. I would like to be able to produce the errorMsg field so I can add it to tables, or grab the errorMsg value for alerts, etc The full search query is below index=its_akana* source="/apps/logs/*" host=ent5*ll5app ("at the below stack trace. Not closed in the same method" OR "Cannot get a connection, pool exhausted" OR "com.digev.fw.exception.GException: Execution of a DB command failed" OR "com.digev.fw.exception.GException: javax.wsdl.WSDLException: WSDLException: faultCode=OTHER_ERROR" OR "com.mongodb.MongoSocketOpenException" OR "com.mongodb.MongoTimeoutException" OR "Data truncation" OR "ERROR [DBStatementAndResultSetTracker] PreparedStatementTracker" OR "Error encountered in WS-Security engine" OR "Error in creating Prepared statement for the query" OR "federation member auth token cannot be refreshed" OR "GC overhead limit exceeded" OR "Illegal character" OR "java.lang.NullPointerException at com.soa.jbi.component.http.marshal.impl.OutgoingExchangeInitializer" OR "java.lang.StackOverflowError" OR "Log block not closed correctly. Enable log block tracking to see diagnostic information" OR "Log frame is closed at the below stack trace" OR "No corresponding startTraceBlock() is seen" OR "No key found in WSDL for service" OR "No process found" OR "No Subject is associated with the call. Only Container identities can invoke this call. Returning authorization error" OR "OutOfMemoryError" OR "Timeout waiting for idle object" OR "Unable to initialize SiteMinder agent" OR "UsageJDBCWriter.writeUsage" OR "Wsdl does not conform to wsdl schema" OR "org.elasticsearch.action.UnavailableShardsException" OR "None of the configured nodes are available" ) | stats [| makeresults | eval errorMsg="at the below stack trace. Not closed in the same method:: com.digev.fw.exception.GException: Execution of a DB command failed:: com.digev.fw.exception.GException: javax.wsdl.WSDLException: WSDLException: faultCode=OTHER_ERR:: com.mongodb.MongoSocketOpenException:: com.mongodb.MongoTimeoutException:: Data truncation:: ERR [DBStatementAndResultSetTracker] PreparedStatementTracker:: Error encountered in WS-Security engine:: Error in creating Prepared statement for the query:: federation member auth token cannot be refreshed:: GC overhead limit exceeded:: Illegal character:: java.lang.NullPointerException at com.soa.jbi.component.http.marshal.impl.OutgoingExchangeInitializer:: java.lang.StackOverflowError:: Log block not closed correctly. Enable log block tracking to see diagnostic information:: Log frame is closed at the below stack trace:: No corresponding startTraceBlock() is seen:: No key found in WSDL for service:: No process found:: No Subject is associated with the call. Only Container identities can invoke this call. Returning authorization error:: OutOfMemoryError:: Timeout waiting for idle object:: Unable to initialize SiteMinder agent:: UsageJDBCWriter.writeUsage:: Wsdl does not conform to wsdl schema:: org.elasticsearch.action.UnavailableShardsException:: None of the configured nodes are available:: Cannot get a connection, pool exhausted" | makemv delim="::" errorMsg | format "" "" "" "" "" "" | rex field=search mode=sed "s/\( errorMsg=| OR errorMsg=/ count(eval(searchmatch(/g s/\" count\(/\")) count(/g s/\s*\) $/))/ s/\"([^\"]+)\"\)\)/\"\1\"))) AS \"\1\"/g"] ... View more

Because errorMsg isn't a native field in the data. It's one I have to create ... View more

That produces a table, which doesn't seem to be picking up the counts of the strings. Each string in the table says 0, but that's not accurate ... View more

What I'm trying to get is a count of how many times each string appears per unit time. That doesn't seem to be happening when I run the amended search: index=its_akana* source="/apps/logs/*" host=ent5*ll5app ("at the below stack trace. Not closed in the same method" OR "Cannot get a connection, pool exhausted" OR "com.digev.fw.exception.GException: Execution of a DB command failed" OR "com.digev.fw.exception.GException: javax.wsdl.WSDLException: WSDLException: faultCode=OTHER_ERROR" OR "com.mongodb.MongoSocketOpenException" OR "com.mongodb.MongoTimeoutException" OR "Data truncation" OR "ERROR [DBStatementAndResultSetTracker] PreparedStatementTracker" OR "Error encountered in WS-Security engine" OR "Error in creating Prepared statement for the query" OR "federation member auth token cannot be refreshed" OR "GC overhead limit exceeded" OR "Illegal character" OR "java.lang.NullPointerException at com.soa.jbi.component.http.marshal.impl.OutgoingExchangeInitializer" OR "java.lang.StackOverflowError" OR "Log block not closed correctly. Enable log block tracking to see diagnostic information" OR "Log frame is closed at the below stack trace" OR "No corresponding startTraceBlock() is seen" OR "No key found in WSDL for service" OR "No process found" OR "No Subject is associated with the call. Only Container identities can invoke this call. Returning authorization error" OR "OutOfMemoryError" OR "Timeout waiting for idle object" OR "Unable to initialize SiteMinder agent" OR "UsageJDBCWriter.writeUsage" OR "Wsdl does not conform to wsdl schema" OR "org.elasticsearch.action.UnavailableShardsException" OR "None of the configured nodes are available" ) | stats [| makeresults | eval errorMsg="at the below stack trace. Not closed in the same method:: com.digev.fw.exception.GException: Execution of a DB command failed:: com.digev.fw.exception.GException: javax.wsdl.WSDLException: WSDLException: faultCode=OTHER_ERR:: com.mongodb.MongoSocketOpenException:: com.mongodb.MongoTimeoutException:: Data truncation:: ERR [DBStatementAndResultSetTracker] PreparedStatementTracker:: Error encountered in WS-Security engine:: Error in creating Prepared statement for the query:: federation member auth token cannot be refreshed:: GC overhead limit exceeded:: Illegal character:: java.lang.NullPointerException at com.soa.jbi.component.http.marshal.impl.OutgoingExchangeInitializer:: java.lang.StackOverflowError:: Log block not closed correctly. Enable log block tracking to see diagnostic information:: Log frame is closed at the below stack trace:: No corresponding startTraceBlock() is seen:: No key found in WSDL for service:: No process found:: No Subject is associated with the call. Only Container identities can invoke this call. Returning authorization error:: OutOfMemoryError:: Timeout waiting for idle object:: Unable to initialize SiteMinder agent:: UsageJDBCWriter.writeUsage:: Wsdl does not conform to wsdl schema:: org.elasticsearch.action.UnavailableShardsException:: None of the configured nodes are available:: Cannot get a connection, pool exhausted" | makemv delim="::" errorMsg | rex field=errorMsg mode=sed "s/[\r\n]//g"| format "" "" "" "" "" "" | rex field=search mode=sed "s/\(| OR / count(eval(/g s/\" count\(/\")) count(/g s/\s*\) $/))/ s/\"([^\"]+)\"\)\)/\"\1\")) AS \"\1\"/g"] | stats count by errorMsg ... View more

This is the full search: index=its_akana* source="/apps/logs/*" host=ent5*ll5app ("at the below stack trace. Not closed in the same method" OR "Cannot get a connection, pool exhausted" OR "com.digev.fw.exception.GException: Execution of a DB command failed" OR "com.digev.fw.exception.GException: javax.wsdl.WSDLException: WSDLException: faultCode=OTHER_ERROR" OR "com.mongodb.MongoSocketOpenException" OR "com.mongodb.MongoTimeoutException" OR "Data truncation" OR "ERROR [DBStatementAndResultSetTracker] PreparedStatementTracker" OR "Error encountered in WS-Security engine" OR "Error in creating Prepared statement for the query" OR "federation member auth token cannot be refreshed" OR "GC overhead limit exceeded" OR "Illegal character" OR "java.lang.NullPointerException at com.soa.jbi.component.http.marshal.impl.OutgoingExchangeInitializer" OR "java.lang.StackOverflowError" OR "Log block not closed correctly. Enable log block tracking to see diagnostic information" OR "Log frame is closed at the below stack trace" OR "No corresponding startTraceBlock() is seen" OR "No key found in WSDL for service" OR "No process found" OR "No Subject is associated with the call. Only Container identities can invoke this call. Returning authorization error" OR "OutOfMemoryError" OR "Timeout waiting for idle object" OR "Unable to initialize SiteMinder agent" OR "UsageJDBCWriter.writeUsage" OR "Wsdl does not conform to wsdl schema" OR "org.elasticsearch.action.UnavailableShardsException" OR "None of the configured nodes are available" ) | stats [| makeresults | eval errorMsg="at the below stack trace. Not closed in the same method:: com.digev.fw.exception.GException: Execution of a DB command failed:: com.digev.fw.exception.GException: javax.wsdl.WSDLException: WSDLException: faultCode=OTHER_ERR:: com.mongodb.MongoSocketOpenException:: com.mongodb.MongoTimeoutException:: Data truncation:: ERR [DBStatementAndResultSetTracker] PreparedStatementTracker:: Error encountered in WS-Security engine:: Error in creating Prepared statement for the query:: federation member auth token cannot be refreshed:: GC overhead limit exceeded:: Illegal character:: java.lang.NullPointerException at com.soa.jbi.component.http.marshal.impl.OutgoingExchangeInitializer:: java.lang.StackOverflowError:: Log block not closed correctly. Enable log block tracking to see diagnostic information:: Log frame is closed at the below stack trace:: No corresponding startTraceBlock() is seen:: No key found in WSDL for service:: No process found:: No Subject is associated with the call. Only Container identities can invoke this call. Returning authorization error:: OutOfMemoryError:: Timeout waiting for idle object:: Unable to initialize SiteMinder agent:: UsageJDBCWriter.writeUsage:: Wsdl does not conform to wsdl schema:: org.elasticsearch.action.UnavailableShardsException:: None of the configured nodes are available:: Cannot get a connection, pool exhausted" | makemv delim="::" errorMsg | format "" "" "" "" "" "" | rex field=search mode=sed "s/\(| OR / count(eval(/g s/\" count\(/\")) count(/g s/\s*\) $/))/ s/\"(\w+)\"\)\)/\"\1\")) AS \1/g"] ... View more

Still throwing the same error ... View more

Now it throws the following error: Error in 'stats' command: You must specify a rename for the aggregation specifier on the dynamically evaluated field 'count(eval( errorMsg="at the below stack trace. Not closed in the same method"))'. ... View more

ie, "eval myField=( "value1", "value2", "value3") | stats count by myField" Where "value1", "value2", "value3" are literal strings. I want to get a count for how many "value1"s, "value2"s, and "value3"s there are ... View more

Okay I took a stab at it, but this doesn't appear to be working: <form> <label>FileNet Errors Clone</label> <fieldset submitButton="false" autoRun="true"> <input type="time" token="time_period" searchWhenChanged="true"> <label>Time Picker</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="ecm_env_hostname" searchWhenChanged="true"> <label>Environment</label> <choice value="p">4 - Production</choice> <choice value="s">3 - Staging</choice> <choice value="q">2 - QA</choice> <choice value="d">1 - Development</choice> <default>p</default> <prefix>"*</prefix> <suffix>l5ecm*"</suffix> <initialValue>p</initialValue> </input> <input type="dropdown" token="refresh"> <label>Refresh</label> <choice value="5s">Every 5 seconds</choice> <choice value="30s">Every 30 seconds</choice> <choice value="0">Never</choice> </input> </fieldset> <row> <panel> <html> <a href="http://www.ibm.com/support/knowledgecenter/SSNW2F_5.2.1/com.ibm.p8.ce.msgs.doc/fnrc000.htm" target="_blank">Content Platform Engine error messages</a> </html> </panel> </row> <row> <panel> <chart> <title>(Environment/Index pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype=log4j:p8:error | timechart count by ErrorCode</query> <earliest>-15m</earliest> <latest>now</latest> <refresh>$refresh$</refresh> <refreshType>delay</refreshType> </search> <option name="refresh.time.visible">true</option> <option name="refresh.link.visible">true</option> <option name="count">10</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <fields>["host","source","sourcetype"]</fields> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> <row> <panel> <single> <title>(Time Period/Environment/Index pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype=log4j:p8:error ErrorCode=* | stats count</query> <earliest>$time_period.earliest$</earliest> <latest>$time_period.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">none</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> <option name="linkView">search</option> <option name="afterLabel">FileNet Errors</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="trendInterval">auto</option> <option name="underLabel">time picker</option> </single> </panel> <panel> <single> <title>(Time Period/Environment/Index pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype="log4j:was:sysout" EventType="*" | stats count</query> <earliest>$time_period.earliest$</earliest> <latest>$time_period.latest$</latest> </search> <option name="drilldown">none</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> <option name="linkView">search</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="trendInterval">auto</option> <option name="underLabel">time picker</option> <option name="afterLabel">Log Errors</option> </single> </panel> </row> <row> <panel> <table> <title>(Time Period/Environment pickers)</title> <search> <query>index=ecmaas* host="*pl5ecm*" sourcetype=log4j:p8:error ErrorCode=* | eventstats count AS totalCount | eventstats count as "choiceCount" by ErrorCode| eval percent=(choiceCount/totalCount)*100 | eval percent=round(percent, 2)| stats values(choiceCount) as "event count" values(percent) as "percent of total" by ErrorCode| sort - "percent of total"</query> <earliest>$time_period.earliest$</earliest> <latest>$time_period.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="drilldown">cell</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </panel> <panel> <table> <title>(Time Period/Environment pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype="log4j:was:sysout" EventType="*" | eventstats count AS totalCount | eventstats count as "choiceCount" by EventType | eval percent=(choiceCount/totalCount)*100 |eval percent=round(percent, 2)| stats values(choiceCount) as "event count" values(percent) as "percent of total" by EventType| sort - "percent of total"</query> <earliest>$time_period.earliest$</earliest> <latest>$time_period.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="drilldown">cell</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </panel> </row> <row> <panel> <table> <title>(Time Period/Environment pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype=log4j:p8:error host=*| eventstats count AS totalCount | eventstats count as "choiceCount" by host | eval percent=(choiceCount/totalCount)*100 | eval percent=round(percent, 2)| stats values(choiceCount) as "event count" values(percent) as "percent of total" by host | sort - "percent of total"</query> <earliest>$time_period.earliest$</earliest> <latest>$time_period.latest$</latest> </search> <option name="wrap">undefined</option> <option name="rowNumbers">undefined</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </panel> <panel> <table> <title>(Time Period/Environment pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype="log4j:was:sysout" host="*" | eventstats count AS totalCount | eventstats count as "choiceCount" by host | eval percent=(choiceCount/totalCount)*100 | eval percent=round(percent, 2)| stats values(choiceCount) as "event count" values(percent) as "percent of total" by host | sort - "percent of total"</query> <earliest>$time_period.earliest$</earliest> <latest>$time_period.latest$</latest> </search> <option name="wrap">undefined</option> <option name="rowNumbers">undefined</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </panel> </row> <row> <panel> <chart> <title>(Time Period/Environment pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype=log4j:p8:error ErrorCode=* | timechart count</query> <earliest>$time_period.earliest$</earliest> <latest>$time_period.latest$</latest> </search> <option name="count">10</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <fields>["host","source","sourcetype"]</fields> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">minimal</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">none</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </chart> </panel> <panel> <chart> <title>(Time Period/Environment pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype="log4j:was:sysout" EventType="*" | timechart count</query> <earliest>$time_period.earliest$</earliest> <latest>$time_period.latest$</latest> </search> <option name="count">10</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <fields>["host","source","sourcetype"]</fields> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">none</option> </chart> </panel> </row> <row> <panel> <event> <title>(Time Period/Environment pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype="log4j:p8:error" ErrorCode="*"</query> <earliest>$time_period.earliest$</earliest> <latest>$time_period.latest$</latest> </search> <option name="count">10</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <fields>["host","source","sourcetype"]</fields> </event> </panel> <panel> <event> <title>(Time Period/Environment pickers)</title> <search> <query>index=ecmaas* host=$ecm_env_hostname$ sourcetype=log4j:was:sysout EventType="*" | timechart count</query> <earliest>0</earliest> <latest></latest> </search> <option name="count">10</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <fields>[]</fields> </event> </panel> </row> </form> ... View more

The indices are "sterling" and "sterling_nonprod". Sterling_nonprod is the only index that works with this search ... View more

index=sterling | eval host=lower(host) | eval permission_type=lower(permission_type) | stats earliest(_time) as earliest latest(_time) as latest values(source) as sources by host index sourcetype splunk_server permission_type fillnull | convert ctime(earliest) ctime(latest) | table index host sourcetype earliest latest sources splunk_server permission_type | sort host ... View more

No. I'm trying to use the field extractor because the info is for a non-dev unit ... View more

Still nothing, unfortunately. If it helps, the amount of whitespace and the number of integers will vary between records. ... View more

No dice. It didn't extract anything. ... View more

What would this look like if I were to plug it into the field extractor tool? ... View more

Works perfectly. thank you my friend ... View more