Is there a way to rename subfields based on a condition? Some of our applications log into fields, say message.message.A, message.message.B, etc, and some apps log the same fields in message.message.log.A, message.message.log.B, etc. Currently in my query, if I have to search for both, I use this: index=* NOT message.message.log.A | rename message.message.* AS * | append [search index=* message.message.log.A=* | rename message.message.log.* AS *] <more commands here> Somehow when I use this it doesnt produce the expected number of events: index=* | rename message.message.* AS * | rename log.* AS * <more commands here> There are about 20 of those similarly named subfields that either in message.message.* OR message.message.log.* What is a better (or best) alternative than append? ... View more

Because alert queries normally look back, say the last 15 minutes to the current time, we need to have our jobs start at say 12:15pm thru midnight. For now our cron schedule is like this: */15 12-23 * * *, which of course runs from 12pm to 23:45. We see an issue where at 12pm, it may produce a false positive; at midnight (the next day) the alert will not run, and thus we may miss an important alert. We want it to run from 12:15pm thru 00:00 (next day), because of the 'look back' to the previous 15 minutes. It may be very simple, but so far I'm at a loss. What is the correct way of doing this? ... View more

For a certain time range, I want to group together the counts in a single row, divided into equal time slices. For example, for  "-15m" I want see 5-minute counts something like this: index Last15MinCount Last10MinCount Last5MinCount APP1     100                      123                               345 APP2    32                          55                                   60 The idea is for me to compare the Last5MinCount to the Avg of Last15MinCount and Last10MinCount. I could not find a suitable way of simplifying my query, but I got this instead (note: times shd have 'at'm; this forum links 'at' to members): index=* earliest=-15m | rex field=message "(?i)(?<ORG>[C]{0,1}+MS\w*)+(?i)\.(?<ENV>[dev|test|prod]+(-pci){0,1})\.+(?i)(?<APP>[\w-]+)" | rex field=_raw ".*(?<level>LEVEL)[\s\S]{0,5}(?<code>FATAL|ERROR|WARN|DEBUG|INFO).*" | eval time15=relative_time(now(), "-15m") | eval time10=relative_time(now(), "-10m") | eval time05=relative_time(now(), "-05m") | eval time00=relative_time(now(), "-00m") | eval etime=_time | eval Time=case(tonumber(etime)>tonumber(time15) AND tonumber(etime) <= tonumber(time10), "Last15", tonumber(etime)>tonumber(time10) AND tonumber(etime) <= tonumber(time05), "Last10", tonumber(etime)>tonumber(time05) AND tonumber(etime) <= tonumber(time00), "Last05") | stats count(eval(Time=="Last15E")) AS Last15 count(eval(Time=="Last10E")) AS Last10 count(eval(Time=="Last05E")) AS Last05 by APP This gives me the desired rows. My question is about these lines: | eval time15=relative_time(now(), "-15m") | eval Time=case(tonumber(etime)>tonumber(time15) AND tonumber(etime) <= tonumber(time10), "Last15" and | stats count(eval(Time=="Last15E")) AS Last15 can probably be combined into one line, but I could not find the most apropriate function. Any help in simplifying this would be appreciated. Thanks!   ... View more

I am looking for a way to list the counts by customer (for example, including 0 activity) for the past hour, among all customers so far that has had activity since the start of the day. Example: John (15), Dave (10) and Maria (8) so far for the day. Within the past hour: Dave (3). The result I am looking for is something like this: John (0), Dave (3), Maria (0). I have looked at map, joins and subsearches, but nothing  so far works. I need to list the 0 activity as well since they have been active for the day, just not in the last hour. Any ideas? ... View more