Hi, I have 2 different events. these 2 events can be identified by "Id".    I am trying to display it in table in the below format, wherein the records should be in a single row api_name,Id,OpName,Response,Current,System_Service_Response event 1 api_name=apple||Id=12345||OpName=Update||Response_Code=200||Response_Status=COMPLETED||Response=[{"number":"99999","status":"Welcome back"}]|| event 2 api_name=apple||Id=12345||System_Name=Oracle||Service_Name=Oracle||Operation_Name=test||System_Status_Code=200||System_Service_Status=COMPLETED||System_Service_Response={"number":"99999","status":"Welcome back"}||Current=99999 My search query displays 2 rows, is it possible to group the events and display in 1 row.   ... View more

search query  |table error_name event error_code=400||error_name=ErrorMsg: Internal Server Error Output ErrorMsg: I should get the output as  ErrorMsg: Internal Server Error ... View more

Request={"headers":{"zip":"500000"}},"location":"HYD","info":[{"phoneNumber":"******6467","test":[{"id":"1234"}]}],"testing123":{"tenure":1234,"stringvalue":"A"}}}   How can search for "stringvalue":"A"?   I tried | makemv tokenizer="([^,]+)," Params | mvexpand line | rex field=Params "(?<key>[^{'stringvalue'':']+) : (?<value>[A]+)" It did not work. ... View more