we have several columns which needs to be changes time to time, line process and comments. ? if we go with scheduled reports, all the 10+ fields has to be configured manually during every change. ... View more

@richgalloway  Thanks for your quick reply, but I have already configure the current time, but still the same issue   ... View more

Thanks for the feedback, with your comment i found that i am missing the _time in my search and i get the expected results when I add _time in dedup   Thanks ... View more

Hi if you don’t use smartstore then you should update your indexes.conf with maxDataSize = auto_high_volume for that index if this behavior is regular. r. Ismo ... View more

Hello @Shweta7775    Did you find any solution for your post, I am also looking for such a solution with MS project   Thanks ... View more

| makeresults count=200 | eval Parent=mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ",""),random()%26) | eval Son=mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ",""),random()%26) | table Parent Son | dedup Parent Son | rename COMMENT as "from here, the logic" | eval tmp=Parent.Son | eventstats values(tmp) as listed | mvexpand listed | rex field=listed max_match=0 "(?<GroundSon1>\w)(?<GroundSon2>\w)" | where Son==GroundSon1 | table Parent Son GroundSon2 | rename GroundSon2 as Groundson | dedup Parent Son Groundson | sort Parent Son Groundson For three category , It can forced to do . ... View more