Hi, Below is a snippet of log pattern generating tons of record. Intending to write a alert if any log are missing for given time time range. sourcetype source activity sourcetype1 myLog.log activity1 sourcetype1 myLog.log activity2 sourcetype2 myLog.log activity3 sourcetype2 myLog.log activity3 sourcetype3 myLog.log activity1 sourcetype3 myLog.log activity2 sourcetype3 myLog.log activity3 Is a search, lookup or simple individual query on sourcetype best approach for making sure logs are generated for each sourcetype? Looking for best approach. Thanks. ... View more

While using post process, I have set base search as "index=_test source="/logs/trans.log" component=core|fields activity". In my post process query, using below search timechart span=1h count(activity) as Activites In my base query, there is no transforming command. When I try to use transforming command like timechart or stats, I do not get any results back. How do I use transforming command to link base search and post process query? ... View more

Hi, I have a dashboard of 2+ panels with one user input. Each panel has its own query that needs to be mapped to a distinguished value. For example: Dropdown Input selected: value1 Panel1 query: index=”application1” Panel2 query:index=”application2” Panel3 query:index=”application3” Dropdown Input selected: value2 Panel1 query: index=”server1” Panel2 query:index=”server 2” Panel3 query:index=”server 3” Summary: Need a mapping of a 1 to many tokens i.e. one user input derives multiple values. Input: value1 tokens:application1, application2,application3 Input: value2 tokens:server1, server2, server3 ... View more