i have logs like this for each req..... 2016-11-09 12:57:18,855 CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696 , GroupNumber =000142003, ServiceLinecount=xx, SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=REQ 2016-11-09 12:57:18,855 CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx, SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=Ack, OutCome= Success , Message text=xxxx 2016-11-09 12:57:18,855 CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx, SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xx, TransactionCode=Response ,UtilizationAmount=xxx. In each message up to vendor code everything is similar .. i need a table with all the details information along with how much time it has taken between req,ACK and ACK,RSP in single table...so that later on i want to build the summary index with those search..... is anyone help in this could appreciate that...!! thanks in advance... ... View more

I have a lot of details in my table, so I want to search values from some of the fields IN THOSE FIELDS There is one relationship between the 2 fields: memzipassignzip and provassignZip. I provassignZip has the value, memzipassignzip value is empty, and if the memzipassignzip has the value, provassignZip value is empty in their respective fields. I want build the report to search the criteria .. My search is like this .. index=$env$ GroupNbr=$GroupNbr$ AND ServiceDate=$ServiceDate$ AND memzipassignzip=$MemZipCode$ OR provassignZip=$ProvZipCode$|table id,Info,StartTime,EndTime,duration,StatusCode,StatusMessage,corpEntCd,Costlvlpctl,cptCode,memZipCode,ProcChrgamt,ProvZipCode,SectionNbr,ServiceDate,TretCatCd,TretCatName,bnftAgrmtNbr,acctNbr,GroupNbr,memzipassignzip,provassignZip i have given the default values for text boxes '*' but am not getting the results ...could anyone help me ..in this query.. ... View more

I have attached the screenshot of my data. I have transaction starttime as inbound message event time and endtime is outbound message event time. I need to calculate the responseTime of each transaction and rest of the fields that I am extracting from the data. after that I need to calculate the summary index for that after that I want use those information in other fields. Below is the search I have used, but after creating the summary index while retrieving them, I am getting all the results. The timestamp of the events is not coming into summary, and I am getting only one timestamp, and that is the summary index created time. I am thinking this was happened because I have performed some stats _time. Can anyone can suggest me in this issue? ![alt text][1] index=*********** source=******* " "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" AND "Inbound Message" OR "Outbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" OR "provZipCode assigned to zipCode" OR "bnftAgrmtNbr" |rex "(?Inbound|Outbound)" |eval transfield=if(searchmatch("Inbound Message") OR searchmatch("Outbound Message"),1,0) | accum transfield | transaction transfield | rex "ID:(?.*)" |rex "(?m)\(?.*)"|rex "(?m)\(?.*)"|rex "(?m)\(?.*)"|rex "(?.*)" |rex "(?.*)"|rex "(?.*)" | rex "(?.*)" | rex "(?.*)" |rex "(?.*)" |rex "(?.*)"|rex "(?.*)"| rex "(?.*)"|rex "(?.*)" |rex "provZipCode assigned to zipCode:(?.*)"| rex "memZipCode assigned to zipCode:(?.*)"|stats min(_time) as startTime,max(_time) as endTime,values(info) as Info,values(ResponseTime) as responseTime,values(StatusCode) as StatusCode,values(message) as StatusMessage,values(CorpEntCd) as corpEntCd,values(costlvlpctl) as Costlvlpctl,values(CptCode) as cptCode,values(GroupNbr) as GroupNbr,values(MemZipCode) as memZipCode,values(procdchrgamt) as ProcChrgamt,values(ProvZipCode) as ProvZipCode,values(SectionNbr) as SectionNbr,values(ServiceDate) as ServiceDate,values(tretcatcd) as TretCatCd,values(tretcatname) as TretCatName,values(bnftAgrmtNbr) as bnftAgrmtNbr,values(acctNbr) as acctNbr,values(provassignZip) as provassignZip,values(memzipassignzip) as memzipassignzip by id,source |eval responseTime=endTime-startTime|eval StartTime=strftime(startTime,"%Y-%m-%d %H:%M:%S,%3N")|eval EndTime=strftime(endTime,"%Y-%m-%d %H:%M:%S,%3N") |table id,Info,StartTime,EndTime,responseTime,StatusCode,StatusMessage,source,corpEntCd,Costlvlpctl,cptCode,GroupNbr,memZipCode,ProcChrgamt,ProvZipCode,SectionNbr,ServiceDate,TretCatCd,TretCatName,bnftAgrmtNbr,acctNbr,provassignZip,memzipassignzip ... View more

I have created one summary index for a scheduled search that runs every 15 minutes, but I did not specify any time range while creating in the report, and am getting every result from starting in the summary index while retrieving the results. How can I only return the events from the last 24 hours?Can anyone help me? Thanks in advance. ... View more