Hello,   I've the following situation: I've inside logs the ETL logs, I've already extracted some data via search fields. The log structure is the following: Fri Dec 1 16:00:59 2023 [extracted_pid] [extracted_job_name] [extracted_index_operation_incremental] extracted_message Example Fri Dec 1 07:57:40 2023 [111111][talend_job_name] [100] End job Fri Dec 1 06:50:40 2023 [111111][talend_job_name] [70] Start job Fri Dec 1 06:50:39 2023 [111111][talend_job_name1] [69] End job Fri Dec 1 05:40:40 2023 [111111][talend_job_name1] [30] Start job Fri Dec 1 05:40:39 2023 [111111][talend_job_name2] [29] End job Fri Dec 1 02:50:40 2023 [111111][talend_job_name2] [1] Start job   Expected: PID          NAME                         EXEC_TIME 111111 talend_job_name 1h 7min 111111 talend_job_name1 1h 10min 111111 talend_job_name2 2h 50min   What I was requested to do is to extract a table containing the job name and the execution time, one for each pid (a job can be executed multiple times, but each time has a different PID) in order to have the data available. It is not necessary that the job starts with index 1, since all subjobs inside a job have a separated logged name (for example, the import all could contain 10 subjobs, each of one with different names) My idea of a query would be a query that involves the PID and the job name combined as primary key, considering the start time the lower extracted_index_operation_incremental for that specific PK and the end time the max value of extracted_index_operation_incremental for that PK. Any help? 😄   Thanks for any reply.     ... View more

Hello there. What I'm trying to do is the following:   search | bucket span=60s _time | stats count by _time | ...   I want to achive if possible the following:   Calculate the average per minute of count of search (if I concatenate the stats avg(count) I get the actual value) but I can't: Have the Single Value panel inside my dashboard to correctly display the trend based on average values. Is there any way to achive this result?   At the moment each try I do to compare those values is not going well 😞       ... View more

Hello there 😉   So, what I'm trying to do is the following. I have inside the log all the slow queries. I'm trying to create a chart to get from the timing of the slow queries, grouped by 10. One bar counting the queries from 0 to 10 sec the other from 10 to 20 and so on...   What I've done so far was that: index="SUG" "slow query" | rex field=_raw "Slow Query (time: (?<OSY_timing>.*)s):" | eval OSY_new=round(tonumber(OSY_timing),-1) | stats count by OSY_new   Unfortunately, I'm not able to see any results inside OSY_new, where I should expect the values rounded by 10 (if I read the documentation correctly). Any hint on how to do that?   Thanks.   P.s. I've the correct values inside OSY_timing ... View more