Hi, I have to plot a graph from 0 to 1 for different clients but didn't finding any exact queries to do so. My problems Each of the clients are maintaining two status started or ended.For some client ended can't appear in logs if some exceptions or errors occurs.I want to plot the graph as 1) 0 in case the client is not started 2) 1 in case it is started but not ended. 3) 0 in case it is ended. 4) 1 in case it is started but not ended i.e running. I have tried some queries but none have give the exact data. earliest="-5d" tag="aa" sourcetype="bb" "Client started." OR "Client ended."|rex "Notification Client - (? [\S]+)]"|rex "Client (? [\S]+)."|eval status=0|eval status=case(ClientStatus=="started",1,ClientStatus=="ended",0)|sort _time|streamstats last(status) by ClientId,_time global=t current=t|timechart last(status) by ClientId I am getting some null values that I want to fill up with appropriate values. Any idea to do so. Thanks ... View more

I want to group the cluster value based on the similar punct. I have used the following query. tag="tagname" sourcetype="sourcetype" ERROR | cluster t=0.9 showcount=true field="punct"| sort - cluster_count | head 10|table punct cluster_count But it is not able to distinguish the different punct like below and gives the count as combination of the count of 1st and 2nd punct. --::,[/#-]:__:.:_://...:/?=&=&=----& --::,[/#-]:__:.:_://...:/?=.&=----&= tag="tagname" sourcetype="sourcetype" ERROR|stats count by punct|sort - count|head 100 All suggestions are welcome! ... View more

I am facing the problem when i am adding "\" inside the searchTemplate query for conditional checks.The same query is working fine when used for the search but not inside searchTemplate . Query inside SearchTemplate: searchTemplate> tag="$tagname$" sourcetype="SrcFile" | eval series1=if(searchmatch("\"first String \" AND \"Second String\""),_time,null()) | timechart span="$splitinterval$" count(series1) as Request </searchTemplate> ERROR :: PARSER: Applying intentions failed Error in 'eval' command: The expression is malformed. Expected ). Please provide any help if possible.I had tried the option for CData inside the tag. Thanks in Advance! ... View more