HI All, Please help me to debug the issue to join two searches based on common field. I have two indexes which has values which can be matched and I want to get field_1, field_2 from first_access_log and field_3 and field_4 from node_access logs. first_access_logs has one trackingId which has one part , we call that nodeTrackingId node_access_log has node tracking id but that is defined in the src_ip field. if I use the inner search to combine two results, the query works but I do not get fields from both search in the final output but only the field from node_access_logs index=node_access_logs "search/api/another?value=&id" [ search index=first_access_logs emp_id=472421 "14616113" "POST" "search/api/values" | rex field=tracking_id ":(?<nodeTrackingId>.+)" | rename nodeTrackingId as src_ip| fields src_ip ] However, when I use this as join query ( I tried by removing type=inner as well from the command ) it does not return any result index=first_access_logs emp_id=472421 "14616113" "POST" "search/api/values" | rex field=tracking_id ":(?<nodeTrackingId>.+)" | join type="inner" nodeTrackingId [ search index=node_access_logs "search/api/another?value=&id" | rename src_ip as nodeTrackingId ] | table field_1,field_2, field_3, field_4 ... View more

Hello, I needed to count total and two individual error Conditions. I used below two query and I was surprised to see both ran in same time for a count of total 100k rows. Option 1) index=<> sourcetype=<> Exception_Stack="*ClassNotFound*" | eval err=case((TYPE_OF_ERROR=0) , "SUCCESS", (TYPE_OF_ERROR=403 ) "Alert",1=1, "Others") | stats count by err Option 2) index=<> sourcetype=<> Exception_Stack="*ClassNotFound*" | stats count as Total, count(eval(TYPE_OF_ERROR=0)) as Success , count(eval(TYPE_OF_ERROR=403)) as Alert But As per my understanding second should have perform better because in this case all the operations would be done in single traverse, however in first case it would be traversing the results multiple time. I would like to know your views. Thanks in advance ... View more

Hello, I have two dates which I need to compare and report if there is difference of more than 1 hour currTime = Tue Apr 24 07:52:18 PDT 2018 currProcTime = Tue Apr 24 06:26:03 PDT 2018 As of now I used regular expressions like below , but is there any easy or efficient way to do this ? | rex field=currTime "(?<hr1>\d{2}):.*:.*" | rex field=currProcTime "(?<hr2>\d{2}):.*:.*"| eval latencyByHour=hr1-hr2| where latencyByHour>0 ... View more

Hello, I need to creating grouping of a results by error code . There are different type of error code like 1123, 0123, 0000, 1234 etc which are specific to my application. The error codes are categorized in 4 category : infra error, customer error, application error, Information_code_not_error One way is to upload a lookup file and use that but I dont have access to do that, only access I have is to run normal queries. Please help me if you know a way to do so Like if value in(1,5,3,2,7) then Code1 else if value in(4,6,0) Code 2 else Code 3 Thanks ... View more

Hi , I have a string like this "details=[ A_0B_0N_0Z_0AB_0AU_0CA_0]^" I need to split the above string by '_' where left side would be a field name and right would be a value. Final requirement is to display all the fileds which has value =10 . Note: The string might have one or many such field/value combination Thanks in Advance. ... View more

HI , I want to extract serialNumber value from the logs. Below is the sample logger \"serialNumber\" : \"A1BZD2C5HD29\". I tried using the below expression to extract the serial Number from the logs. The regular expression mentioned in the quotes is performing right in the regex101 site but it is not rex field=response "\\\"serialNumber\\\"\s+:\s+\\\"(?<srLNumber>\w+)" Below is the complete sample response object (pasting , as it may be because of the text arrangement in the object) response=" { \"FetchedDetails\" : { \"TimeStamp\" : \"312345677122199\", \"serialNumber\" : \"C12SDJGRHLND7\" } }" The size of the serial number can vary to any length and it would contain only alphanumeric characters. I tried multiple options else like using .+ instead of \w+ but it did not work. An advice to select the serial number is appreciable. Thanks ... View more

Hello, I need to execute a search where the 5 fields from one search would be used to search another data. Also, I need to get two fields from inner search to make a report but those fields would not be used in the outer search. I have renamed those fields but still the search for the outer search does not give any result. Example index=my_com sourcetype=my_desk [ search index=my_com sourcetype=my_desk query=*database_data* |rename transaction as txn, values as val |fields workstation, date_min, date_second, date_hour, date_day, txn, val ] query=*file_data* values!=val |table workstation, txn, val, transaction, values But the above search is not working ... View more

HI, I have a search in which I am interested in three fields: index=my_computer sorucetype=asia_data message="Null_fields" | table item_id, country, count My data has the same item id for multiple countries, say : Item1 for CHN,JPN. IND etc. Also, it can occur multiple times for the same country. There could be multiple hosts for the same country. SO I want results in the format ITEM_ID Countries HOST Item1 CHN, JPN Host1, host2 I tried using mvcombine, but it does not give the result as per my expectation. ... View more