Hello,  I am searching to get results for each hour  top 1 max URL hits.  Iam using the below search but not getting results for each hour. index=*  | fields Request_URL _time | stats count as hits by Request_URL _time |bucket span=1h _time | sort by hits desc | head 1 Thanks in advance! ... View more

    "my base query 1 to Total _count_of_sucess_transactions" | rex "URI\s*(?<URI>[^\=\n]+)" "my base query 2 to trackTotal _count_of_Failed_transactions" | rex "gov\^*(?<URL>.*)"     I want the below table to be shown 1)  column 1 Total count of Success transactions  2)  column 2 Total count of Failed Services 3) column 3 Percent of success rate    ... View more

Hi, I need  to extract the below events i tried this  | rex "URI\s(?<URI>.+?)="   but not working. i want to extract for the 1& 2 events before the "=" URI /api/Hellothisistest?customerNumber=244479 URI /api/Hellothisistest?customerNumber=247370 URI  /api/Getthisextractessample URI  /api/createthisextractesof URI  /api/liverpooltestsoccer   Thanks in Advance   ... View more

Hi I am using the below query and i need the results in hourly basis for the time i selected ?   "My Base search"   | fields TRAN_TIME_MS PAGE_ID PAGE_TITLE _time| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | where TRAN_TIME_MS <= Percentile | stats count avg(TRAN_TIME_MS) as avg_time max(TRAN_TIME_MS) as max_time by PAGE_ID,PAGE_TITLE, | eval avg_time=round(avg_time/1000,2) | eval max_time=round(max_time/1000,2) | rename count as Total_Requests avg_time as Average(Seconds) max_time as Max_Time(Seconds) PAGE_ID as Page_ID PAGE_TITLE as Page_Description   ... View more

Hello  - I am getting the below error. I am trying to add pipe "|"  for all the results.  Error : Failed to parse templatized search for field 'ResponseTime(ms)' My search :  | table PeriodDate VendorName ContractName OccMetricCode Pagekey TransactionType TransactionDatetime ResponseTime(ms) Comment | foreach * [ eval <<FIELD>>="|".<<FIELD>>."|"]    I am not getting pipe seperated results only for ResponseTime PeriodDate  ResponseTime(ms)  Comment  |2022/08/30| 0 ||   Thanks in advance   ... View more

How Can i just get the message alert in mail showing only the  failed job example "Job=[ADM-FILENET-DLY]] " instead of the complete log.   Note: The Job names are dynamic    My Current Alert Query : index=* host=*MYhost* "*IN-RCMCO-DLY*" OR "*ADJ-RECERT-DLY*" OR *AD*-*Y*" FAILED job_status2=FAILED OR status=FAILED OR status1=FAILED OR ExitCode=FAILED | rex field=_raw ".*status:\s\[(?P<status1>\S+)\]" | rex field=_raw "JOB\s(?P<job_status2>\w+)" |rex field=_raw "(exitCode=)(?<ExitCode>\w+)" | eval _raw=substr(_raw, 1, 1500) | table _time job_status2 status1 status ExitCode _raw   log  22-08-28 18:01:31,323 INFO [main] c.l.b.listener.JobCompletionListener: :::::::::::::::BATCH JOB FAILED:::::::::::JobExecution: id=21099, version=1, startTime=Sun Aug 28 18:01:29 CDT 2022, endTime=Sun Aug 28 18:01:31 CDT 2022, lastUpdated=Sun Aug 28 18:01:29 CDT 2022, status=FAILED, exitStatus=exitCode=FAILED;exitDescription=com.ltss.fw.exception.ApplicationException: Error occured while processing appDocument: In catch block, exception stackTrace,job=[JobInstance: id=21099, version=0, Job=[ADM-FILENET-DLY]], jobParameters=[{chunkSize=null, skipLimit=null, commitInterval=null, time=1661727689449, asOfDate=1661662800000}] ... View more