by date so that it should be display in one line. ... View more

output in two lines ideally it should be in one line only   ... View more

which I  changed the time to Date. ... View more

the one you shared | rex max_match=0 "\<Transaction (?<transaction>.*)\s\/\>" | mvexpand transaction | rex field=transaction "Name=\"(?<name>[^\"]+)\"\sTime=\"(?<time>[^\"]+)\"\sDuration=\"(?<duration>[^\"]+)\"" | eval time=strptime(time,"%d/%m/%Y %H:%M") | eval {name}=duration | fields - name duration | stats values(*) as * by time | fieldformat time=strftime(time,"%d/%m/%Y %H:%M") | table time SIline PrimaryAddress SearchInServicing NavExistingAddresses it's coming like this way not remove second and furthers too         ... View more

it's pulling data but it's scattered the values in multiple row. probably it's bez of  mvexpand transaction if we can ignore the seconds from the date that would be great.   ... View more

when I removed below line from the code i'm getting the header detail but no value against them except the date column. also changed time to Date in the code (refer the attachment) stats values(*) as * by time   index=XXXXX | rex "Name=\"(?<name>[^\"]+)\"\sTime=\"(?<Date>[^\"]+)\"\sDuration=\"(?<duration>[^\"]+)\"" | eval time=strptime(Date, "%d/%m/%Y") | eval {name}=duration | fields - name duration | fieldformat time=strftime(Date, "%d/%m/%Y") | table time SIline PrimaryAddress SearchInServicing NavExistingAddresses ... View more

like i said earlier your whole query worked properly but when i run only the below code it's not giving me any output. refer below screenshot.     ... View more

when I run the whole command including raw, it worked for me as well. but when I run only these commands , it gives me header detail but not any value again them except dates column refer below screenshot   | rex "Name=\"(?<name>[^\"]+)\"\sTime=\"(?<Date>[^\"]+)\"\sDuration=\"(?<duration>[^\"]+)\"" | eval Time=strptime(Date, "%d/%m/%Y %H:%M") | eval {name}='duration' | fields - name duration | stats values(*) as * by Date | fieldformat Time=strftime(Date, "%d/%m/%Y") | table time SIline PrimaryAddress SearchInServicing NavExistingAddresses please refer the attached actual data available in splunk. ... View more

no result found, hope you saw the requirement. refer attachment again  ... View more

Used below command and got the result but when i run second command not getting any result can you please suggest on this * index=xxx sc_status=201 *index=xxx sc_status=201 AND sc_status=200   any help highly appreciated.   ... View more

use these fields extract index=xx_api | rex "^(?P<Date>[^ ]+)(?:[^\-\n]*\-){5}\s+(?P<Host_Name>[^ ]+)\s+(?P<Status>\d+)\s+(\d+\s+)+(?P<Time_Taken>.+)" | search Status=200 how can pull the report with -Total Hits,  -avgerage(time-taken) order by Client Wise   Regards   ... View more

Saw the interesting fields with Status and time_taken. i was looking for query Client wise Hits and Average response time(time_taken) Thanks in Advance.   ... View more

Thanks. Got the header of fields of the logs as follow but what would the query to pull status code and order by Client wise. also in the interesting fields status and time-taken not showing. is this the site of "https://www.debuggex.com/cheatsheet/regex/pcre"   1 3/1/21 3:00:01.000 AM   #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken host = XXXXX source = E:\acbsapi\Logs\wlUat\IIS\Site_wlUat\W3SVC1\u_ex210301.log sourcetype = XXX 2 3/1/21 3:00:01.000 AM   #Date: 2021-03-01 00:00:01 host = XXX source = E:\acbsapi\Logs\wlUat\IIS\Site_wlUat\W3SVC1\u_ex210301.log sourcetype =XXX 3 3/1/21 2:00:03.000 AM   #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken host = XXX source = E:\acbsapi\Logs\wlUat\IIS\Site_wlUat\W3SVC1\u_ex210301.log sourcetype = XXX 4 3/1/21 2:00:03.000 AM   #Date: 2021-03-01 00:00:03 host = XXX source = E:\acbsapi\Logs\wlUat\IIS\Site_wlUat\W3SVC1\u_ex210301.log sourcetype = XXX 5 2/28/21 10:49:06.000 PM   2021-02-28 20:49:06 W3SVC1 XXX 100.72.153.196 GET /Portfolio/02/Loan/920029607/LoanTransaction absolutePosition=0&startDate=2021-02-26T00:00:00 9004 sa_esb_acbs_qa 100.72.210.0 HTTP/1.1 Apache-HttpClient/4.0.1+(java+1.5) - - acbs-api-uat-fhb.fisglobal.com 200 0 0 453 2159 143 host = XXX source = E:\acbsapi\Logs\wlUat\IIS\Site_wlUat\W3SVC1\u_ex210228.log sourcetype = XXX ... View more