Team, I have been using this below commands to verify whether particular print queues have printed from the print server. But I am in need of a query ,filtering the print queues which are offiline \error from many years. host=USSLCP1OPTIO0* SourceName=*Print* | rex "printed on (?<Printer_queue>\w+)" |rex "port (?<Port>\w+)" |rex "Size in bytes: (?<Size>\w+)" | search Printer_queue = * | timechart count(_raw) by Printer_queue host=USSLCPRTHPENG0* SourceName=*Print* | rex "printed on (?<Printer_queue>\w+)" |rex "port (?<Port>\w+)" |rex "Size in bytes: (?<Size>\w+)" | search Printer_queue = * | timechart count(_raw) by Printer_queue limit=150
... View more