hi @LRF , thanks for your response. it worked ... View more

Thanks Jamie. It worked ... View more

sure @PickleRick . Thank you ... View more

@PickleRick ,      "Build failed" is what i need to check in each event logs over the last 1 hour. If its repeated more than 3 times(from 3 events) in last 1 hour i need to send an alert. I hope you get my question now 🙂    Thanks. ... View more

@gcusello ,      How can i add time in my query for the time (last 1 hour) ?   Thanks. ... View more

Hi @gcusello ,      Yes, its the solution as you mentioned. I am running a basic query to look for the events over the last 1 hour of time and when the count is '0' i have to send an alert. Below query i am running. Can you please check if its right? Also, how to mention time period in last 1 hour in my search query?   sourcetype="logs" | stats count | where count=0   Thanks. ... View more

one more thing that, i need to run this query for every 1 hour. If count is '0' for the last one hour of the search i need to send alert ... View more

Hi rich, I already accepted your first comment as the solution to my question. Thanks. ... View more

Now i understood how to run it properly. All working good now. Thank you ... View more

@richgalloway ,     This is how i am extracting the JOB_NAME form the splunk logs Logs: proj_url\tst[0;x= https://git.mycompany.project.git plan\tst[0;x=XbzuPbsj Splunk query i am using here:        | rex "(?<url>https\S+)" The output returns the value of https://git.mycompany.project.git .   Is there a way to eliminate .git in this query and return just  https://git.mycompany.project ? ... View more

@richgalloway ,     Your answer is perfectly fine. I have a small problem running the query to replace an extension. To get this right, i am trying to extract a git url in my actual task. The git url looks like below.  https://git.mycompany.project.git   here, i am trying to remove '.git' from the end of the project url. I am running below command you suggested,   to remove '.git' . But there is name 'git' at the beginning of the url as well.  | eval foo=replace(JOB_NAME,".git","")."-".JOB_ID   The final output is coming like this. expected output:   https://git.mycompany.project Actual output:  https:/.mycompany.project.    I just want to eliminate the .git at the end of the url. Not the first .git from url. Can you please suggest me how to overcome this?   Thanks.   ... View more

@richgalloway ,   The command you suggested is working as i need. I have another question. The JOB_NAME output is "abcd.exe". The output i am getting after running the command you suggested is "abcd.exe-456". Can you please suggest me how to delete '.exe' from the output? Thanks. ... View more

@ITWhisperer ,   Its working now. Made a slight change from your command. Not sure it its appropriate or not. is there any way we can compare these two values  or same or not (if system1=system2)    | rex max_match=2 "system:\s(?<system>[\S]+)" | eval system1=mvindex(system,-1) | eval system2=mvindex(system,0)   ... View more

@ITWhisperer ,   Logs in one event are: user: user1 system: system1   user:user2 system: system2   output should look like below: output1      output2 system1     system2   I tried as you suggested. Not returning any values. ... View more

Logs in one event are: user: user1 system: system1 user:user2 system: system2 output should look like below: output1 output2 system1 system2 ... View more