About HelloItsMe76

HelloItsMe76 · ‎12-19-2022

this is beautiful. thanks so much. it works perfectly.

HelloItsMe76 · ‎12-16-2022

I have a dbquery ouput that looks like the below, unfortunately i cant update the actual database query to make it more readable... 2022-12-16 21:30:17.689, TO_CHAR(schema.function(MAX(columnA)),'MM-DD-YYHH24:MI')="12-16-22 16:29" I am trying to whether time the 2 times at the begining and end of the results are within 15 mins of each other. I have tried renaming the column from the long stupid string but i cant get that working using the rename function. does anyone have any ideas how to rename (or if i even need to) and then evaluate whether the times are within 15 mins of each other? the query i ran to get the above is just <index="abc">

HelloItsMe76 · ‎09-12-2022

thanks, that worked.

HelloItsMe76 · ‎09-12-2022

When i search for the string "ERROR" in a log i get the below < DEBUG : blah blah INFO : blah blah blah ERROR : <some error string> More blah blah > I want to only show the whole line that starts with ERROR. The length of the error line is variable. How can i do this? I do understand that fixing the line breaks formatting in prop.conf might be a quicker way but i dont have access to that file so would like to do it in the result head. thanks in advance.

HelloItsMe76 · ‎07-14-2022

actually it did work. i had been using 'by Category' on both fields. thanks for the help!

HelloItsMe76 · ‎07-14-2022

Hey, thanks for the response. yes i have and it returns the correct data for the 2 fields but it doesnt pass in the Category field which i need. How can i get all 3 fields?

HelloItsMe76 · ‎07-14-2022

HelloItsMe76 · ‎02-03-2022

Thanks for the reply.. one small update to my original post is that it should read "duration > 2" at the end. to clarify - both strings will appear in all the 10 hosts. at the moment my search is comparing strings from different hosts, it should not do that. I understand i can create 10 alerts (1 for each host), but i would like to find a more efficient way and do it in 1 alert. So i am looking to go through each host in the source / index and evaluate string1 vs string2 on host1, then go to host2 and so on up to host10.

HelloItsMe76 · ‎02-02-2022

I have an index which searches across 10 hosts. I am comparing 2 strings and evaluating the results to see if there is an issue that needs alerting. The results are being messed up as its evaluating the 2 strings from 2 different boxes - ie string1 on hostA against string2 on hostB. It should be string1 on host1 against string2 on host1. Then go to host2 , host3 ..... host10. How can i get my search to either sequentionally go through each host or have the results group by host to not show results that have come from 2 diff hosts. current logic is: index="abc" "string1 OR string2" | transaction startswith="string1" endswith="string2" | where count>2

Posts	9
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎02-02-2022

Online Status	Offline
Date Last Visited	‎12-19-2022 12:10 PM

How to fix column name and evaluate times?

How to display only a substring of result set?

How to create a table with max and sum values

How can i search 1 host at a time when index hits ...

Re: Fix column name and evalute times

How to fix column name and evaluate times?

Re: How to display only a substring of result set?

How to display only a substring of result set?

Re: Create a table with max and sum values

Re: Create a table with max and sum values

How to create a table with max and sum values

Re: How can i search 1 host at a time when index h...

How can i search 1 host at a time when index hits ...