Another method (which is more accurate then bucket) is as below:- sourcetype=TranData | eval Date=strftime(_time,"%Y-%m-%d %H") | stats count as "Transaction Count" by Date Problem with bucket is that if the query is executed in first 30 min, the base time to calculate may become :30. ... View more

yes i thought the command ...| transaction TransactionID | ... will return the correct results but it is not. If use ...TransactionID..., it will return the correct results, how come? ... View more

It seems like the poster was just looking to remove PART of a log or event, but the answer given will remove the ENTIRE EVENT . ... View more

Given your question here, and in other posts I suggest that you read up on regex in general. e.g. http://www.regular-expressions.info http://gskinner.com/RegExr/ In this case (one of) the answer(s) is; rex field=source "/app/(?<item>[a-z]+)([^/]+/){2}.+(?<system>[^-]+)\.log$ Which is; find '/app/', then take any a-z characters and call them item . Then jump over any non-slash characters followed by a slash, twice. Then skip through any characters, until you find a set of non-dash characters followed by .log at the end of the string. Call these non-dash characters system . /K ... View more

Just a comment: "|reverse" is overkill here. Transaction understands that it should be in time order. ... View more