Updates answer also works like a charm. Thanks for the help.. ... View more

Updates answer also works like a charm. Thanks for the help.. ... View more

never mind, I'll post this as a separate question. Thanks for the help Kamlesh. ... View more

This works exactly as requested. Thanks. I would actually like to enhance on the question. Say I have 100 rows of logs. some have only Field abcXYZ1 and not the other 2, some have field abcKLM and not the other 2 and so on... so occurrence of fields abc* is mutually exclusive. Now based on this, want to add another field EVENT which will look if that log has field abcXYZ1 then value of EVENT = abcXYZ1, if a log has field abcKLM then EVENT=abcKLM and so on... So looking at a log and finding which type of field it has based on abc*, only that fields name will be stored as value in the new field EVENT. Hope it is clear to understand. ... View more

ok, after some digging, might have found the issue. To add data there are initial 3 options, Upload / Monitor / Forward. I had selected Monitor ( which is for external sources like Files - HTTP - WMI - TCP/UDP - Scripts Modular inputs for external data sources). Now instead I selected Upload (from local PC, this also allows you to upload from drives from servers which are mapped in your PC). When I did this, while adding data it gave me option to 'Set Source Type' (which is not available in Monitor). In there was option to play around with timestamp (use current / parse data). So I didnt need to edit props.conf anymore. ... View more

The file that I am indexing is not local to my PC, its from a server location. May be that's why the changes I make to props.conf doesn't work? ... View more

Yes and yes for both the questions. also matched the case. Still doesnt work. ... View more

for the 1st query above i removed makeresults and streamstats and re-did the evaluation on temp field of time instead of _time , as below and it gave me the same results. base search | eval t=_time | eval offset=relative_time(now(),"@m")-relative_time(now(),"@h"), t=t-offset | bin t span=1h | eval t=t+offset | stats range(_time) AS Range, latest(_time) AS Latest count BY t, ErrCode | eval LastEvent=strftime(Latest, "%Y-%m-%d %H:%M:%S"), t=strftime(t, "%Y-%m-%d %H:%M:%S") is this correct way? as per the results, its the same as using the initial query with makeresults and streamstats moreover curious on "eval _time=_time-count" to what does it do as per calculations? since _time would be in time format and count would be a number ... View more

Hey, I tried the 2nd query and it works perfect. Thank you. I still dont know clearly how it works. Can you help me understand or provide some link to some documentations? as you mentioned this will work only in case my time span is one hour, in case i need to change it to x minutes i believe there needs to be a different evaluation. one other thing I noticed is this does a stats count by changing the event time itself? so if current time is 09:22 and my 2 events occurred at 09:01 and 08:40, the query returns me the correct count of events as 2 that occurred between 08:22 and 09:22. but it also changes the _time field values as well.. it now shows that both events occurred on 08:22 which is exact 1 hour before now. in other words i would like to get the stats count from time span relative to now, but keep the original event times as it is. so output should give stats count of 2, but also latest(_time) should give me 09:01. I did this by saving the _time in temporal field say Time ( eval Time=_time) and performed time operations on the field Time. so latest(Time) now gives me the correct value when the latest event occurred in that interval. Is this correct way to do or is there a better way? ... View more

Thanks for the reply. i have not used time modifiers before so will have a bit of a learning curve here. ill definitely try this out. ... View more

But now i have another issue with this. the moment i use the bin command my Range values in the stats go blank. so when i say, Search query | bin _time span=(now(), "-1h") | stats range(_time) AS Range, latest(_time) AS Latest count BY _time, A, B, C, basically adding time based columns in the stats command, the Range value goes to 0 when i use bin command. ... View more

Hey, thanks for the reply. yes i did and for some reason it treats 60m same as 1h, i can see bucketing being done hour to hour. when i change it to 59m, then the bucketing changes to exact last 59mins. ... View more

wow. it worked perfect. at first didn't work. then figured out I needed to convert my field to mv before applying any mv functions on it. final query : ....| makemv delim="," Field1| mvexpand Field1| stats count by Field1 ... View more