About giuces

giuces · ‎11-16-2021

thanks aasabatini, i'm little be confused where do i have to insert portion of search yo suggest in the old one ...| stats count(eval(action="accepted)) AS "Total Accepted" count(eval(action="rejected)) AS "Total rejected" by product | rename product AS Product | table Product "Total Accepted" "Total Rejected" ? Regards

giuces · ‎11-16-2021

Hi all, i need to create a table that count for every product how many events are accepted or rejected. In addition to this fields the latest event date should be shown with the count. Table should be like this Product Latest Accepted Total Accepted Latest Rejected Total Rejected Bike 10/11/2021 35 12/11/2021 14 Skate 11/11/2021 99 13/11/2021 5 the first part of the query is pretty easy: ...| stats count(eval(action="accepted)) AS "Total Accepted" count(eval(action="rejected)) AS "Total rejected" by product | rename product AS Product I'm not able to retrieve the latest date for every kind of action, tried with latest(_time) without success. Many thanks

giuces · ‎01-29-2021

Hello, I have to index a log file that has only the timestamp HH:MM:SS , HH:MM:SS field1 field2 ... whenever a new row is added i should merge the actual date with the log timestamp YY/MM/DD HH:MM:SS . i wasted a whole day to combining props and transforms configuration without success, Anyone can help me to solve ? Thanks

giuces · ‎01-11-2021

thank you, i accepted the solution. I hope it is the right way to upvote it.

giuces · ‎01-11-2021

I Rich, thank you for the reply. It is a valid solution, but in case i have to use UF in both nodes is there a possible workaround ? thanks and regards

giuces · ‎01-09-2021

Hi guys, I should find a solution to ingest a file on a network share that is managed from two server behind a load balancer. In my case i should install an UF on every server and check the same file, if i have well understood the UF has not a kind of cluster/balancing awareness so if the file is updated from one server i risk to have the same data ingested from both of them. How i can manage this kind of behaviour and avoid that new data is ingested from the temporary passive server ? Unfortunately i cannot use a third server to monitor the file and bypass the issue. Thanks

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-09-2021

Online Status	Offline
Date Last Visited	‎11-16-2021 02:32 PM

Table with count and latest date

Props manipulate date

Universal forwarders ingestion behind F5 LB

Re: Table with count and latest date

Table with count and latest date

Props manipulate date

Re: Universal forwarders ingestion behind F5 LB

Re: Universal forwarders ingestion behind F5 LB

Universal forwarders ingestion behind F5 LB