About Luninho

Luninho · ‎12-15-2022

I want to cut data that goes up to the fourth symbol "|". How can i do it through | rex? Example data: 2022-12-15 15:27:38.073 - INFO | TID = 1878892572955613 | reactor-http-epoll-36 | x.x.x.x.xxxxx.xxx.xxxClient | Response from url=https://xxxxxxxx:8081/xxxx xxxx xxxxxxxx 2022-12-15 15:27:38.082 - INFO | TID = | http-xxx-8080-xxxx-100 | r.n.m.d.d.l.i.util.InfoLoggingUtil | xxxMethod xxxxxx xxxxx {Parsed: bytes=276 | xxxxxxxxMethod.xxxxxxxxMethodData="eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6ImY3YzIwZTI4LTAzMTctNDFmYS1hZTU5LTkyMzdkZmY4YmNjZCIsInRocmVlRFNNZXRob2ROb3RpZmljYXRpb25VUkwiOiJodHRwczovL3BheW1lbnRjYXJkLnlvb21vbmV5LnJ1OjQ0My8zZHMvZmluZ2VycHJpbnQvbm90aWZpY2F0aW9uLzI3OS9ZR3JmQ21pUS1MdUg1cTFHX2xQTzNLNGFHTzhaLi4wMDIuMjAyMjEyIn0=" | xxxxxxxMethod.param=""} I want: Response from url=https://xxxxxxxx:8081/xxxx xxxx xxxxxxxx xxxxxxxxMethod.xxxxxxxxMethodData="eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6ImY3YzIwZTI4LTAzMTctNDFmYS1hZTU5LTkyMzdkZmY4YmNjZCIsInRocmVlRFNNZXRob2ROb3RpZmljYXRpb25VUkwiOiJodHRwczovL3BheW1lbnRjYXJkLnlvb21vbmV5LnJ1OjQ0My8zZHMvZmluZ2VycHJpbnQvbm90aWZpY2F0aW9uLzI3OS9ZR3JmQ21pUS1MdUg1cTFHX2xQTzNLNGFHTzhaLi4wMDIuMjAyMjEyIn0=" | xxxxxxxMethod.param=""}

Luninho · ‎01-28-2022

I have value in field: value: 10,5 CC,00136;CY,00004;JE,00004;QK,00004 Where CC,CY,JE - type message and there are more of them than in example 00136,00004 - number of message But I need to get table: Type Count CC 136 CY 4 JE 4 How can i do it with SPL language?

Luninho · ‎01-14-2021

I have the field - DATE, for example: DATE: ^9F33006E0F848^00950108080008000^9F37008B1832B33^9F1E0163236353132303337^9F26016B9F12AB2FA191854^9F36003003F^00820041980^009C00200^9F1A0040643^009A006210114^9F02012000000058700^5F2A0040643^9F03012000000000000^9F2700280^9F340061F0002^9F3500222^0084014A0000006581010^9F090040002^9F41006023804^9F100640FA501A030002000ED085B191CB9E97C10040000000000000000000000000000 I need to cut only ^9F10*, for example: DATE: ^9F100640FA501A030002000ED085B191CB9E97C10040000000000000000000000000000 How to do it?

Luninho · ‎12-25-2020

I have the search: | tstats count where index=fologs module IN (G*) by module | sort -count limit=8 But I have a problem - there are several modules with name G10MIP* which always have min count 30, so I want to show only count >30 for modules with name G10MIP*

Luninho · ‎11-26-2020

forget to add these fields in question. I use field @"TIMEIN"

Luninho · ‎11-26-2020

I have two indexes: INDEX1 and INDEX2. In these indexes have the same fields: FIELD1, FIELD2, FIELD3 but they can have different values. For example: INDEX1: FIELD1=5, FIELD2=8 INDEX1: FIELD1=5, FIELD2=7 I need to get a table where will be show only fields with different values in different indexes. According the previous example: |INDEX1|FIELD2=8| |INDEX2|FIELD2=7| or something similar

Luninho · ‎11-26-2020

I have 2 indexes: index1 and index2. I need to compare values in both indexes and show only differences in fields. In both indexes always exist the same field - time, so I need match by this field. For example: Index1 Time - 26.11.20 Field1 - xxxx Field2 - xxxx and Index2 Time - 26.11.20 Field1 - xxxx Field2 - xxxy I want to get a table: Field2 - xxxx Field2 - xxxy

Luninho · ‎11-23-2020

I have 2 searches: 1) |dbxquery query="select member, gate, port from fo.member connection=fo_member" 2) |dbxquery query="select description from fo.date connection=datelog" How I can union them into one search? I tryed to use |union and |join between each other but it didn't work.

Luninho · ‎11-23-2020

I have 2 searches: 1) |dbxquery query="select member, gate, port from fo.member connection=fo_member" 2) |dbxquery query="select description from fo.date connection=datelog" How I can union them into one search? I tryed to use |union and |join between each other but it didn't work.

Luninho · ‎10-29-2020

You helped me however I improved your idea: |timechart span=1m sum(count) |fillnull

Luninho · ‎10-29-2020

I need show any value in every minute, but I only get value > 0 Search: | tstats count WHERE index=XXXXX C_TXN_A IN (1,2) C_TXN_B IN (1) ((C_TXN_C IN (1,2,3,5) AND C_TXN_D IN (5,6)) OR (NOT C_TXN_C IN (4,6) AND C_TXN_D IN (7,8))) by _time span=1m | sort _time After that, I get: 2020-10-29 10:45:00 47 2020-10-29 10:40:00 12 But I want to get: 2020-10-29 10:45:00 47 2020-10-29 10:44:00 0 2020-10-29 10:43:00 0 2020-10-29 10:42:00 0 2020-10-29 10:41:00 0 2020-10-29 10:45:00 12 How to do it?

Luninho · ‎10-21-2020

Time is not displayed on hover. How can this gap be resolved?

Luninho · ‎09-28-2020

I need to get 3 columns: host, port, description from text: 10.224.19.18 | 2222| New server 10.198.18.18 | 2443 | IFT etc I use curl-command and output=text

Posts	14
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎09-28-2020

Online Status	Offline
Date Last Visited	‎01-12-2023 07:51 AM

How to cut data to fourth character "|"?

How to divide a value from a string into fields?

How to cut the value using REX command

How to show values that are greater than 50 in a...

Compare several fields from 2 indexes

How to compare values in fields from 2 indexes?

DB Connect: How union 2 dbxquery from 2 different ...

How union 2 dbxquery from 2 different tables

How show 0 when not result

Time doesn't appear on the chart