Hi So I've used Field Extractions to name 2 different fields in my logs: "dealtCurrency" and "dealtCurrencyDefault". The dealtCurrencyDefault field will ALWAYS appear in my logs. However, the dealtCurrency field appears only in some logs. When the dealtCurrency appears, my regex ignores the dealtCurrencyDefault field altogether. So, my regex only ever gives me one field back - dealtCurrencyDefault (if there is no dealtCurrency), and dealtCurrency (if there is dealtCurrency). I'm now trying to create a chart that displays the "currency" along the x axis and the "number of occurrences" along the y axis. How can I write a search query that creates this chart? I've tried things along the lines of: ...| eval currency=coalesce(dealtCurrency,dealtCurrencyDefault) | chart sum(currency ) as suma by currency This gives me all the currencies, but it doesn't sum them to create the "number of occurrences" field (I just get empty field for the suma column). Any ideas? Should I be using 'buckets'? Not really sure how to use them... Thanks! (Also not sure if the title is accurately describing this - so please feel free to suggest a more suitable one) ... View more

Hi I have 4 hosts. Each host collects error logs. Each log consists of a Counter, like so: 2013-12-02 11:23:26,512 INFO type=COUNTER error count=1 So every time there is an error, the count=n part of the log increases. I want to plot the amount of errors over time. I've set up a field extraction, called ErrorCount, for the number within "count=n". Using max(count), I have used the following search: "type=COUNTER" ErrorCount=* host=lonrs10000 | timechart max(ErrorCount) However, I have 3 further hosts, with their own counters running. How can I edit my search to include the other 3 hosts data? E.g. for a specific day: the count of errors on host lonrs10000 = 5 the count of errors on host lonrs20000 = 4 the count of errors on host lonrs30000 = 2 the count of errors on host lonrs40000 = 0 The total for this specific day should be 11. I am looking to get the total number of errors as a result from my search. . Thanks a lot, Phil ... View more