Good day Team, I have a application which contains 5 servers. Each server is having different path. But the end is to read error.log and wrapper.log /log/apple/production/A1/error.log /log/ball/production/A2/error.log .. Here I can use regex like this in monitor stanza -- /log/*/prodcution/*/error.log But the problem is each server is having many folders for that *. I dont want all folders. Need only few.  Say the first star. I want only apple or ball or cat. If it is any other name in any server I can ignore Similarly take the second star. I want only A1 or A2  or A3. I can ignore B1 or C1 or so.    So is it possible to write like that using any regex either in inputs itself or using props? ... View more

I have a CSV file for ingestion like this. This needs to be monitored via inputs. I dont want to use INDEXED_EXTRACTION= CSV here. Without this I am able to get the feed in successfully. But not able to extract the fields I wanted File sample "NAME","AGE","GENDER" "John","32","MALE" "ROSE","23","FEMALE" #props [mysourcetype] FIELD_DELIMITER = , FIELD_NAMES="NAME","AGE","GENDER" HEADER_FIELD_LINE_NUMBER=1 HEADER_FIELD_DELIMITER = , FIELD_QUOTE = " HEADER_FIELD_QUOTE = " DATETIME_CONFIG = CURRENT SHOULD_LINEMERGE=false NO_BINARY_CHECK=true No luck. Any ideas? ... View more

Good day. I have a CSV File like this. I wanted to do this ingestion via monitoring in inputs. And we should not use INDEXED_EXTRACTIONS=CSV as well. My ingestion is working fine as like normal monitoring Question : How to add the fields which is present in header. I had like this in my props which was not working props FIELD_DELIMITER = , FIELD_NAMES="name","age","class"   Do I need to any other like FIELD _QUOTE for include the double quotes or any other header attribute to include? Kindly help   "name","age","class" "alice","26","grade3" "bob","24","grade2" ... View more

Can we get a query to fetch the savedsearches/dashboards which are running with timerange more than 24 hours   In oour search environment users are running the search in higher timeranges which is causing much load to our Infra. till it gets stabilized we wanted to allow users to run only searches within 24 hours not like Last 3 months / All time / Before This data kind of queries. So we wanted to filter such queries and inform the users. If its much critical we will allow them. Is there any way to pull like that? ... View more

I have a table like below. Which plots different services under one column Service A (Subservices - A1 to A5) / Service B (Subservices - B1 to B5) .  I need to take a new column denotes one Final Status like this if any of one Status is RED then the final status is RED, If there is no RED but one YELLOW And many GREEN then final status if YELLOW. What will be the best condition i can use to achieve the final one result Service Status A1 GREEN A2 RED A3 YELLOW A4  GREEN A5 GREEN ... View more

I have a table like below each row is having different metrics. The requirement is  If metric is "User count" then I need to set color range for Value column like this Green=0-10 Red=10-20 Yellow=20-30 etc. If metric is "Day count" then I need to set color range for Value column like this Green=0-100 Red=100-200 Default=Yellow So for each Metrics the Value column range is going to differ. How to achieve this Metric 1 Value User count 30 Age count 42 Days  count 25 ... View more