Hi richgalloway the below query gives me all the required  results when OR "status" OR "Path" is added to the query.   However, its taking the wrong time stamp. Its taking the difference between the first two events.  i need the duration of  "Successfully completed execution" - "Starting execution for request" time stamps.  "My Base query"  ("Starting execution for request" OR "Successfully completed execution" OR "status" OR "Path") | rex "status:\s+(?<Status>.*)\"}" | rex field=_raw "\((?<Message_Id>[^\)]*)" | rex "Path\:\s+(?<ResourcePath>.*)\"" | rex "timestamp\:\s+(?<timestamp>.*)\"" | stats min(timestamp) as startTime, max(timestamp) as endTime, values(*) as * by Message_Id | stats values(*) as * by Message_Id | eval end_timestamp_s = endTime/1000, start_timestamp_s = startTime/1000 | eval duration = end_timestamp_s - start_timestamp_s | eval human_readable_etime = strftime(end_timestamp_s, "%Y-%m-%d %H:%M:%S"), human_readable_stime = strftime(start_timestamp_s, "%Y-%m-%d %H:%M:%S"), duration = tostring(duration, "duration") | table Message_Id human_readable_stime human_readable_etime duration Status ResourcePath ... View more

Hi @ richgalloway  Thanks for the reply,The query looks good but I am missing  the below two fields  in the results. Can help in getting them populated. 1) | rex "status:\s+(?<Status>.*)\"}"  2) | rex "Path\:\s+(?<ResourcePath>.*)\""  ... View more

Hi  @yuanliu  How do i get the difference of the time stamp? . I want the difference of starting timestamp and the completed time stamp "My base query" | rex "status:\s+(?<Status>.*)\"}" | rex field=_raw "\((?<Message_Id>[^\)]*)" | rex "Path\:\s+(?<ResourcePath>.*)\"" | eval timestamp_s = timestamp/1000 | eval human_readable_time = strftime(timestamp_s, "%Y-%m-%d %H:%M:%S") | transaction Message_Id startswith="Starting execution for request" endswith="Successfully completed execution"   RAW_LOG 8/19/24 9:56:05.113 AM {"id":"38448254623555555", "timestamp":1724079365113, "message":"(fghhhhhh-244933333-456789-rrrrrrrrrr) Startingexecutionforrequest:f34444-22222-44444-999999-0888888"} {"id":"38448254444444444", "timestamp":1724079365126, "message":"(fghhhhhh-244933333-456789-rrrrrrrrrr) Methodcompletedwithstatus:200"} {"id":"38448222222222222", "timestamp":1724079365126, "message":"(fghhhhhh-244933333-456789-rrrrrrrrrr) Successfullycompletedexecution"} {"id":"38417111111111111", "timestamp":1724079365126, "message":"(fghhhhhh-244933333-456789-rrrrrrrrrr) AWS Integration Endpoint RequestId :f32222-22222-44444-999999-0888888"}                 ... View more

Hi  @ITWhisperer  Thanks for your response. I had not extracted any yet cause the logs are not yet in splunk but will be soon  Yes, the transaction ID are unique.  The below is what i got from cloud watch.   2024-08-12T10:04:16.962-04:00          (434-abc-345789-de456ght) Extended Request Id: cmtf1111111111111111= 2024-08-12T10:04:16.963-04:00          (434-abc-345789-de456ght) Verifying Usage Plan for request: AAAAAAAAAAAAAAAAAAAAAAAA 2024-08-12T10:04:16.964-04:00          (434-abc-345789-de456ght)  BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB 2024-08-12T10:04:16.964-04:00          (434-abc-345789-de456ght) AAAAAAAAAABBBBBBBBBBBBBCCCCCCCCCCCCCCCCCC 2024-08-12T10:04:16.964-04:00          (434-abc-345789-de456ght) Starting execution for request: 8hhhhh-cdcd-434444-8bbb-dedr44444 2024-08-16T10:04:16.964-04:00          (434-abc-345789-de456ght) HTTP Method: POST, Resource Path: /ddd/Verifyffghhjj/ddddddd 2024-08-16T10:04:25.969-04:00          (434-abc-345789-de456ght) Successfully completed execution 2024-08-16T10:04:25.969-04:00          (434-abc-345789-de456ght) Method completed with status: 200 2024-08-16T10:04:25.969-04:00          (434-abc-345789-de456ght)  AAAAAA Integration Endpoint RequestId: 11111111111111111111 ... View more

Hi  @isoutamo,  The below is the raw event. I dont have access to props.conf. so just wanted to extract the time stamp from the raw event. 2024-08-13 17:49:23,006 [https-mmme-nio-1111-exec-2] ERROR   ... View more

Thanks for the help! @gcusello. I fixed my rex Iam seeing results now. ... View more

Thanks @KendalW for the help! ... View more

Hello, @gcusello. Thank you for your response. I had an issue with Rex. I corrected that now, and your earlier query works for me. ... View more

Hi gcusello, Thanks for the reply,  Iam looking to get results like below. my base search | rex "^[^=\n]*=(?P<ServiceName>[^,]+)" | rex "TimeMS\s\=\s(?<Trans_Time>\d+)" Results ServiceName         Trans_Time Count A 60 1111 B 40 1234 Other_Services( C , D, E, F,G,H) 25 1234567 ... View more

Thank you for the help @yuanliu  ... View more

Hi @bowesman Thanks for the reply Please find the below snap shots for the query. I had masked my base search.. fyi  my base search is same for the subsearch as well.   ... View more

Hi @richgalloway  Thanks for the response but i was looking for the results which gets  PAGE_ID=* and  the subsearch  "PAGE_ID=DGEFH OR PAGE_ID=RGHJH NOT NUM_OF_MONTHS>=6 AND NOT NUM_OF_INDIVIDUALS_ON_CASE>=4" ... View more

Hi @richgalloway  Thanks for respnding i dont see the results as expected. 1) Yes the fileds in URI and URL are same but from different events 2)  i havent defined the  Total_count_of_sucess_transcations ( URI ) & Total_count_of_failed_transcations(URL) this info comes from the rex  in  the query.     ... View more

Thanks @gcusello  modifed your query and helped  | rex "URI\s*(?<URI>[^\=\n]+)"  worked for me   ... View more