I have  logs like below  findContractsByPersonId(String) executed in 463 milliseconds findContractsByPersonId(String) executed in 4,681 milliseconds findContractsByPersonId(String) executed in 3,671 milliseconds findContractsByPersonId(String) executed in 681 milliseconds and i want to create a field which will give values from log like below 463 4,681 3,671 681 i did filed extraction with below log findContractsByPersonId(String) executed in 463 milliseconds i am able to create filed but i can only get non coma separated values, i mean i am getting only  463 681 values i am not getting coma included values (those are 4,681 and 3,671) could you please suggest in order to get all the values (comma included values also) ... View more

I have two queries and i want to display both the query result in line chart (one line in the line chart from the result of query 1 and  another line in the line chart from the result of query 2) below is the query which i append the two queries ,but i am not getting proper line chart index="cx_aws" host="aw-lx0244.deltadev.ent" source ="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode|bucket _time span=1h | stats count by _time |append [search index="cx_aws" host="aw-lx0244.deltadev.ent" source="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode | eval TimeTaken3 = trim(replace(TimeTaken, ",","")) | eval REQUESTED_URL2 = trim(replace(REQUESTED_URL, "/contracts/",""))| eval REQUESTED_URL3 = trim(replace(REQUESTED_URL2, "/enrollees","")) | sort -num(TimeTaken3) | WHERE TimeTaken3>10000|bucket _time span=1h | stats count by _time]  please suggest in order to achieve the two line sin the line chart(one for each query) ... View more