I have this multivalue fields where i am tring to rex and get particular field value like  "value":"ESC1000",  but instead getting multiple. Tried with this but shows all the fields value  | rex max_match=0 "value\":\"(?<ESC>[^\"]+)" "productChanges":[ { "Products":[ { "productSpecContainmentID":"1", "changedCharacteristics":[ { "characteristicID":"2", "value":"SERVICE" }, { "characteristicID":"3", "value":"99" }, { "characteristicID":"4", "value":"monthly" }, { "characteristicID":"5", "value":"ESC1000" }, { "characteristicID":"6", "value":"Discount" }, { "characteristicID":"7", "value":"Escalation" }, { "characteristicID":"8", "value":"AMOUNT" }, { "characteristicID":"9", "value":"9" }, { "characteristicID":"10", "value":"Y" }, { "characteristicID":"11", "value":"N" } ], "temporaryID":"xxxaaaacccc" } ] } ] Is there a way to get the required fields value only like above? ... View more

I have a csv file which has data like this and i am using  | inputlookup abc.csv | search _time >= '2023-09-10" but its is not showing any data _time client noclient 2023-09-10 iphone airpord 2023-09-11 samsung earbud   how do i get the data only for the selected date like from the above query ... View more

I have a requirement to build a dashboard, when selected between through date and time range suppose  8/16/2023 17:00:00 and  8/16/2023 18:00:00. And want to show results for these dates as well as the previous day same hour results todays count  yesterdays count 100 200   is it possible to have auto search and show two results through one time picker selection? ... View more

I 've  two fields one is _time and another one is received_time.  I want to get the time differences between these two timestamp.   Logs look like  2023-07-11 11:19:24.964 ..... received_time= 1688574223791 I converted the epoch to human readable but i couldnt get the time differences  between these two timestamp. my search: <query> | rex "received_time\"\:(?<recTime>[^\,]+)" | eval recTime = strftime(recTime/1000, "%Y-%m-%d %H:%M:%S.%3N") | eval diff = recTime - _time | table recTime _time diff but it doesnt show any data on diff. Am I missing something?   ... View more

I have 2 kind of logs where there are two types of uri which i want to rex into different fields {logType=DOWNSTREAM_RESPONSE, requestUri=https://google.come.com:8000/google/api/updateapi?&lo=en_US&sc=RT, duration=22, requestId=znXdSxbJQw6iVTtEeykZVA, globalTrackingId=null, requestTrackingId=null, request={body={"a":{"b":{"country":"US", }}}, method=POST, requestUri=https://google.come.com:443/google/api/updateapi?&lo=en_US&sc=RT}, response=(200 OK, { "body="{} }, "headers="{}, "statusCode=OK", statusCodeValue=200}")"} {logType=DOWNSTREAM_RESPONSE, requestUri=https://google.come.com:8000/google/api/deleteapi, duration=33, requestId=asdasd, globalTrackingId=null, requestTrackingId=null, request={body={"a":{"b":{"country":"US", }}}, method=POST, requestUri=https://google.come.com:443/google/api/updateapi?&lo=en_US&sc=RT}, response=(200 OK, { "body="{} }, "headers="{}, "statusCode=OK", statusCodeValue=200}")"} http= https URL= google.come.com:8000 service = /google api= /api/updateapi api= /api/deleteapi params= ?&lo=en_US&sc=RT is there a way to regex this?   ... View more