Hi @bhaskar5428, Check out the following: index=*1644* container_name="ls2-sdp-java" $selected_countries$ | rex field=_raw "\[(?<country>[^,]+),\s(?<cobDate>[^,]+),\s(?<sdpType>[^,]+)," | rex field=_raw "Number of records:\s*(?<Recordcount>\d+)" | rex field=_raw "^(?<dateTime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+Z)" | eval DateTime=strptime(dateTime, "%Y-%m-%dT%H:%M:%S.%NZ") | eval CreatedTime=strftime(DateTime, "%H:%M") | eval CreatedDate=strftime(DateTime, "%Y-%m-%d") Example with makeresults: | makeresults | eval _raw="2025-03-28T22:04:25.685Z INFO 1 --- [ool-1-thread-11] c.d.t.l.s.s.e.e.NoopLoggingEtlEndpoint : Completed generation for [DE, 2025-03-28, LOAN_EVENT_SDP, 1]. Number of records: 186" | rex field=_raw "\[(?<country>[^,]+),\s(?<cobDate>[^,]+),\s(?<sdpType>[^,]+)," | rex field=_raw "Number of records:\s*(?<Recordcount>\d+)" | rex field=_raw "^(?<dateTime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+Z)" | eval DateTime=strptime(dateTime, "%Y-%m-%dT%H:%M:%S.%NZ") | eval CreatedTime=strftime(DateTime, "%H:%M") | eval CreatedDate=strftime(DateTime, "%Y-%m-%d") | table _raw dateTime country cobDate sdpType Recordcount CreatedTime CreatedDate   🌟 Did this answer help you? If so, please consider: Adding kudos to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @bhaskar5428 , it should be already extracted because Splunk recognizes the pais:field=value; anyway, you could try this regex: orderId\=(?<orderId>[^\]]+) that you can test at https://regex101.com/r/OtSfRS/1 Ciao. Giuseppe  ... View more

Adding to @gcusello 's answer. A quote is not in itself a special character within a regex so within the regex itself it doesn't have to be escaped - on regex101 you could just do "error":\{"errorCode":"(?<errorCode>[^"]+)" (In this case you could also get away with not escaping the opening brace but it doesn't hurt and prevents accidental not-escaping when needed). But as you're putting the regex in a string as part of the command - then you need to escape your quotes as part of the string so the strings are not interpreted as the end of string. That's why you end up with (notice double backslash before opening brace  - you also need to escape the backslash if you want it to be literally included in the string) "\"error\":\\{\"errorCode\":\"(?<errorCode>[^\"]+)\""   ... View more

Hi @bhaskar5428 , you need a correlation key that cannot be a simple string, in this case you need to extract this field: in your case, the correlation key should be orderId, so you could run something like this: index = app_events_sdda_core_de_prod source="/home/sdda/apps/logs/sep-app/app-json.log" level=TRACE | rex field=message "\"orderId\":\"(?<orderId>[^\"]+)\"},\"error\":\{\"errorCode\":\"(?<errorCode>[^\"]+)\"" | fields orderId errorCode | dedup orderId | table orderId, errorCode | append [ index = app_events_sdda_core_de_prod "Process transaction locally" b95d0d10-9709-4299-9d3e-8c65dd5a539d source="/home/sdda/apps/logs/sep-app/app-json.log" | rex field=message "deliveringApplication=(?<AppID>\w+)" | rex "(?<orderId>\w{8}-\w{4}-\w{4}-\w{4}-\w{12})" | dedup AppID | table AppID orderId ] | stats values(errorCode) AS errorCode values(AppID) AS AppID BY orderId This solution has only one limit: you must be sure that the second search will have less than 50,000 results, otherwise, you need a different solution Ciao. Giuseppe ... View more

It would help if you post the data as text instead of a photo of it. ... View more

What do you mean by "console width limit"? If an event is split into two separate ones it's either because it's split before it reaches Splunk or it hits the LINE_BREAKER for give sourcetype. If the event was too long it'd simply get truncated, not split. And no, you can't join two separate events in Splunk - each event is processed as separate entity (in fact with distributed environment each of those events could end up on a different indexer). ... View more

Assuming your ingest has already parsed your timestamp into the _time field, then you can just format that to get the time | eval Time=strftime(_time, "%I:%M %p") ... View more

Hi @bhaskar5428 , You need to change the regex capture group to cover only time, like below; | rex field=_raw "\"@timestamp\":\"\d{4}-\d{2}-\d{2}[T](?<Time>\d{2}:\d{2})"   ... View more

Check out Splunk Cheat Sheet: Query, SPL, RegEx, & Commands | Splunk At the end of the blog post you will find the splunk-quick-reference-guide in pdf format. ... View more

Good luck with that - I have no idea what that would even look like or where to start! 😎🤔😁🦄 ... View more

Thank you so much ... View more

1. Don't search over index=* unless you really have your data all over your indexes. Limiting by index is one of the most efficient way of improving performance 2. You're using AND whereas it seems that you want OR ("ORC from FCS completed" namespace="dk1371-b") OR (index=* "ORC from ROUTER completed" namespace="dk1692-b") OR (index=* "ORC from SDS completed." namespace="dk1399-b") ... View more

Hi @bhaskar5428, let me understandd: you need an alert (or a report) that checks with a predefined frequency (e.g. one day) youe events and every time sends a message with "Success" or Failure", is this correct? if this is your need, you should schedule a report or an alert like this: index=your_index | stats count | append [| makeresults | eval count=0 | fields count ] | stats sum(count) AS total | eval status=if total=8,"Success","Failure") | table status if you defined an alert, you can pass the status value as a token to the content of the eMail. Ciao. Giuseppe ... View more

@bhaskar5428  A web resource a lot of people use, is https://crontab.guru/. I'm not affiliated in any way with the tool, but for years, it's not steered anyone wrong. What's cool about it is it can help you understand the plain-English of the cron expression @ITWhisperer gave you. Check here to see the expression pre-populated: https://crontab.guru/#0_18_*_*_1-5 ... View more

There are two issues (apart from my original remark about wildcards) here. Three even. I understand that you have a "main" timestamp in your event as well as other time-related field. And you want to filter on that other field. It boils down to the normal search for a value or range of values in a field. Firstly, you still have to limit your search to some timerange - of course you can search "All time" but that's highly ineffective. So you have to approximate some timerange in which "your" event should be and limit your search timerange to those times. (for example, if looking for events "from" 2022-05-09, you might look for events back from 2022-05-08 till 2022-05-10). Secondly, to make the searching easy, you should, as @isoutamo mentioned, have the field extracted so it's easy to match the field by its name. And thirdly, you have two possible approaches. 1) Use a subsearch to render the date to a string and use that as a condition in the main search. or 2) Just search for all events from a given timerange and limit the results with - for example - evaling a temporary field to a yesterdays date and comparing the values of the temporary field to your date field with | where. ... View more

[dbdiNotificationService,ServiceManagement] {} - Caught Runtime exception at service dbdiNotificationService   ----------------------------------------------------------- its giving me above output only    ... View more

It usually works the other way around - you need to decide what it is you are trying to show with a chart, then you look to see if there is an appropriate chart type available, then you work out what the search should be to show you the information you want from your data. ... View more

Not working,   however below working for me  rex field=_raw "^[^\-\n]*\-\s+(?P<Error>.$)" ... View more

Thanks , it worked  ... View more