Hi - trying to parse 2 similar sourcetypes with props.conf and transforms.conf but they are not working.  Help would be appreciated! Thanks! Example events: sourcetype=avaya:epm:mpplogs @2021-11-19 09:41:54,070|PAVB_03335|INFO|VB|650636|Session=aipor-mpp001lv-2021323144040-7|Got VoiceXML exception: noinput in 9b99c62c5d35f81d18e547137018bef9663c3bc7a33f60a3f25aa4d55d36e14f|aipor-mpp001lv#### sourcetype=avaya:epm:vpmslogs @2021-11-19 09:51:10,411 EST||FINE|AppIntfService|VoicePortal|ajp-nio-127.0.0.1-3009-exec-41|Method=PackageInfo::GetBuildVersion()| attempt to locate file on classpath. File = VPAppIntfService.aar|||||||aipva-epm001lv|4000064385####   props.conf [avaya:epm:mpplogs] REPORT-pipe-separated-fields-mpp = pipe-separated-fields-mpp [avaya:epm:vpmslogs] REPORT-pipe-separated-fields-vpms = pipe-separated-fields-vpms   transforms.conf [pipe-separated-fields-mpp] DELIMS = "|" FIELDS = "eventTimestamp","eventName","eventLevel","triggerComponent","eventId","eventText","eventDescription","serverName" [pipe-separated-fields-vpms] DELIMS = "|" FIELDS = "eventTimestamp","eventName","eventLevel","triggerComponent","eventMonitor","eventDescription" (I've tried with and without quotes) ... View more

Hello - I have JSON events that have multiple items nested inside them.  Each item has fields with the same name.  I'm trying to report with stats and timechart on specifically "lastvalue_raw" for each "sensor" however when trying a few different things my query still chooses the first "lastvalue_raw" for any of the sensors.  The JSON event could have any number of nested items within it depending on the type of sensor.  Below is an example event:         { "prtg-version": "21.1.65.1767", "treesize": 2, "sensor": [ { "device": "Colo Palo Alto FW1", "device_raw": "Colo Palo Alto FW1", "objid": 8219, "objid_raw": 8219, "sensor": "Comcast (1Gbit/s - Circuit ID)", "sensor_raw": "Comcast (1Gbit/s - Circuit ID)", "status": "Unusual", "status_raw": 10, "lastvalue": "37 Mbit/s", "lastvalue_raw": 4637266.8945 }, { "device": "Colo Palo Alto FW1", "device_raw": "Colo Palo Alto FW1", "objid": 33904, "objid_raw": 33904, "sensor": "Verizon Business (1Gbit/s - Circuit ID)", "sensor_raw": "Verizon Business (1Gbit/s - Circuit ID)", "status": "Up", "status_raw": 3, "lastvalue": "163 Mbit/s", "lastvalue_raw": 20343218.0333 } ] }         And here is an example of a query I have tried to separate them:         index=prtg_test sourcetype=_json | spath | rename "sensor{}.lastvalue_raw" AS lastvalue, "sensor{}.sensor" AS sensor | timechart span=1m latest(lastvalue) by sensor         Any help is greatly appreciated! ... View more