I want to create a report with search query, Is there any way to use field transformation in it? For example: <query>eventtype="AWB" | fieldtransformation = fieldtransformationname.</query> </search> Thanks. ... View more

Sample Log: [02.22.2017 03:48:33.985] INFO - [CargoHub.com.aa.cargo.SPL.AirWaybillSCPSModule] TID[WMQJCAResourceAdapter : 7288] SID[sabre:AWBReplication] RID[601528076] [<== com.ibm.bpe.generated.Abstract_PT_ ==> MQ AWB Message Processing took :18666.0 milliseconds for AWB # 89536053] As per the business requirement, I want to extract two different kind of fields set, from the same log. In other words i want certain fields (common across all the log entries like logtime, loglevel etc) to be displayed at the search level and certain fields (event specific fields) to be displayed at the report/dashboard level. So I created two field extractions, I created below field extraction, which displays the basic fields (logtime,loglevel) at search level. \[(?.*)\]\s+(?.*) - \[(?.*)\] TID\[(?.*)\]\s+SID\[(?.*)\]\s+RID\[(?.*)\] [<== com.ibm.bpe.generated.Abstract_PT_ ==> MQ AWB Message Processing took :18666.0 milliseconds for AWB # 89536053] I created below field extraction, which displays event specific fields and I want to show this values from Report/dashboard panel and I don't want this fields to be available at search level under (selecting fields and interesting fields). .*MQ AWB Message Processing took :(?.*) milliseconds for AWB # (?.*)] Since i can only able to define field extraction at source, host or sourcetype level. So by default both basic fields and event specific fields are populating at search level itself. How to resolve it? Is there any way to achieve my requirement through event type? ... View more

Hi, We are trying to break the following lines based on date/timestamp but multiline event is not working as we expected, can some one please us on this issue. Sample log: [02.13.2017 15:35:47.920] INFO - [CargoHub.ShipmentPieceModule.ShipmentPieceServiceImpl.createShipmentPiece] TID[WMQJCAResourceAdapter : 4] SID[sabre:AWBReplication] RID[29004928] [<== cargo.PreLogHandler ==> Pre Log :Shipmentpiece goods qty count 4] [02.13.2017 15:35:47.923] INFO - [CargoHub.AirWaybillSCPSModule] TID[WMQJCAResourceAdapter : 2] SID[sabre:AWBReplication] RID[29004929] [<== com.ibm.bpe.generated.Abstract_PT_ ==> Create Itinerary Process : End] [02.13.2017 15:35:47.929] INFO - [CargoHub.ShipmentPieceModule.ShipmentPieceServiceImpl.createShipmentPiece] TID[WMQJCAResourceAdapter : 4] SID[sabre:AWBReplication] RID[29004928] [<== com.ibm.bpe.generated.Abstract_PT_ ==> (ShipmentPiece Module -> ShipmentPieceAggregateServiceImpl -> createPieceAggregate) started] [02.13.2017 15:35:47.939] INFO - [CargoHub.ShipmentPieceModule.ShipmentPieceServiceImpl.createShipmentPiece] TID[WMQJCAResourceAdapter : 4] SID[sabre:AWBReplication] RID[29004928] [<== com.ibm.bpe.generated.Abstract_PT_ ==> (ShipmentPiece Module -> ShipmentPieceAggregateServiceImpl -> createPieceAggregate) finished] [02.13.2017 15:35:47.940] INFO - [CargoHub.ShipmentPieceModule.ShipmentPieceServiceImpl.createShipmentPiece] TID[WMQJCAResourceAdapter : 4] SID[sabre:AWBReplication] RID[29004928] [<== cargo.PostLogHandler ==> Post Log : Exit from Process Goods qty count 4] we want to break the line based on timestamp sample( [02.13.2017 15:35:47.920] ) Please find below the configuration we added at props.conf on server side. BREAK_ONLY_BEFORE = ^\[\d+\.\d+\.\d+\s+\d+:\d+:\d+\.\d+\] MAX_TIMESTAMP_LOOKAHEAD = 150 NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = true TIME_FORMAT = %m.%d.%Y %H:%M:%S.%3Q pulldown_type = 1 ... View more