2 events : request and response and unique id which binds this transaction. I have  issue where i have to calculate the total duration between request and response and average , max and min response time from all the transaction triggered per day/per hour. the below query works in extracting request and response but duration is not being calculated, or displayed  when i run the query : search query | stats earliest(dateTime) AS request latest(dateTime) AS response BY TransactionID | eval duration=response- request   result for above query : TransactionID                                                                          Request                                              Response 000877d43ef8778123243454bda780c5e5     2022-05-05 01:36:12.916      2022-05-05 01:36:13.27 Please help in writing query for calculating duration and avg, max,min response time for all the transaction happened in a day ... View more

I have a field(eventCode)  which has a code values, and few of them ends with certain alphabets , I want to extract only the eventCode which ends with E, F, V and display it separately under different fields/names(minor, major, medium). I tried with | where eventCode=*E, but this doesnot work.. Is there any other way to extract other than rex/regex. If not, can you please provide some input.  Exmaple : eventCode=xyxbxsndsndg-5-3000-E eventCode=aksjdjfdfvbrhgnvfmbfbc-54-3601-E eventCode=plgkdfdcmasjenfmdklv-61-2501-F eventCode= pojdksdjhmmmaskxjs-91-4501-V Result : Minor                                                              Major                                                                         xyxbxsndsndg-5-3000-E                                       plgkdfdcmasjenfmdklv-61-2501-F             aksjdjfdfvbrhgnvfmbfbc-54-3601-E ... View more

Hello @Anonymous  Please help me out here. I was trying to extract a field "faultDescription". but the logs have different format for each event.  event 1: "faultDescription" : "Backend system error has occurred.", event 2 : <soafault:faultDescription>SKU is not provided</soafault:faultDescription> event 3: <soafault:faultDescription>SKU is not provided</soafault:faultDescription>   i have tried below rex command, and it works for event 1 and 3. But how to write a command which will extract fault description in all 3 formats. There is space between faultdescription" and : hence not able to write a expression which will involve all 3 events   i have tried : | rex field=_raw "faultDescription+.\s:\s(?P<description>.+),"  ... View more