I want the difference between two timestamps in epoch. My fields are like: target.received.end.timestamp 1597115254203 target.received.start.timestamp 1597115254203   So need the difference between end and start timestamp. Any help would be helpful.   Thanks ... View more

Hi,   I have following kind of url : https://abc.com/loc/country/123/iss https://abc.com/a1/v1/country/456.json?returnFields=attr,add https://abc.com/a1/countries/456/av/int/orig/curr I want to extract numbers(123,456) , in url whatever comes after country / countries , want that digit. Thanks in advance Thanks,   ... View more

Hi,   I have two different queries, I want to join two columns. Below is my query:   `macro` msg="Finish import*" OR msg = "*inserted for*" | rex field=msg "Finish import (?<dataField>.+)\s*at\s+(?P<datetime>\S+\s+\S+) processing time=(?<processingTime>\w+)" | where trim(dataField)="postcode" | append [ search `macro` msg="*inserted for*" | rex field=msg "(?<records>\d+)+\s[^\s].+for(?<dataField1>.*)" | where trim(dataField1)="postcode" ] | eval records1 = records+":"+processingTime | transaction msg maxpause=100s | strcat records "::" processingTime recordsPr | table datetime, dataField, records,ts,processingTime, recordsPr,dataField1. I want to combine records and processingTime in one column like records:processingTime. With eval records1 its doesnot concatenate but with string concatenate it looks like below:    Any help, would be appreciated.   Thanks, ... View more

Hello,   Is there any way, I can check the sequence of logs. For example: I have following list of msg  1. "Message arrived!"  at 2020-06-22 17:19:28.032  2. "Message Received" at2020-06-22 17:19:28.047 3. "Start import" at 2020-06-22 17:19:28.047 4. "Finished with number of records 123 " at 2020-06-22 17:19:28.215 I want to create chart if for these different messages and also the number of records. Thanks, ... View more