In logs there are multiple lines printed like below  and I want to print all of them in a table but my search query only prints one value , need help to print multiple records  Balance amount is zero for invoice id:20220402-126-12300-A Balance amount is zero for invoice id:20220502-126-12300-B Balance amount is zero for invoice id:20220602-126-12300-C Need to print like : 20220704-126-77300-A, 20220404-126-77300-A , 20220704-126-77300-A query I am trying : rex field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)" ... View more

Unable to pull similar number 53726516638.77 (in billion) using chart for past 7 days. Dashboard only pulls data for only 1 day. rex filed example :   rex field=_raw "(?ms)^\\w+/\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\.\\s+\\w+/\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\.\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+:\\s+\\d+\\.\\d+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+:\\s+\\d+\\.\\d+\\s+\\w+\\s+\\w+\\s+\\w+\\s+:\\s+\\.\\d+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+\\s+\\w+:\\s+(?P<TotalAsset>[^ ]+)" offset_field=_extracted_fields_bounds | eval mytime=strftime(_time, "%b%d") |chart values(Total_Assets_Price) by mytime log output : Want to pull total asset on pricing and previous date but somehow only pulls data for 1 day ... View more