It works. Thank you.   but same problem i have. Please refer to above reply. ... View more

query  index=ddos | rex field=_raw "(?<time>.*),(<alert_num>.*),(<error>.*),(<duration>.*)"   event 20230112, 1378, error A/B/C, duration 100 20230112, 1378, error A/B, duration 2 20230112, 1379, error A/B/D, duration 300 20230112, 1379, error A/B, duration 4   and then query  index=ddos | rex field=_raw "(?<time>.*),(<alert_num>.*),(<error>.*),(<duration>.*)" | eventstats max(duration) as maxDuration | where duration=maxDuration event (only 1) 20230112, 1379, error A/B/D, duration 300     I want to display two event that different alert_num 20230112, 1378, error A/B/C, duration 100 20230112, 1379, error A/B/D, duration 300 ... View more

It works. Thank you!!   more question...   index=log   There are four event   1. 20230112, 1378, error A/B/C, duration 100 2. 20230112, 1378, error A/B, duration 2 3. 20230112, 1379, error A/B/D, duration 300 4. 20230112, 1379, error A/B, duration 4 I want select 1,3 ... View more

It works. Could you explain purpose of stats, format? ... View more