Hi, can any one help me how to get splunk query for below requirement. index="abc" | search "message"="Exit" | search "stepName"=NotifyFlowEnd | search stepName!="" | search "message"="PAST_TIME_FRAME" |  chart count by "message" In message="Exit"  these 2 conditions need to include ----->     | search "stepName"=NotifyFlowEnd | search stepName!=""   Output is to get Sum of  "message"="Exit"  +  "PAST_TIME_FRAME" count ... View more

log: {“timeMillis”:“1667091964927",“timestamp”:“2022-10-30T01:06:04.927Z”,“thread”:“reactor-http-epoll-3",“level”:“INFO”,“logger”:“com.status”,“message”:“Business Key=null, Publishing  status : [ client_req_id fd6e03ea-99ed-4f0c-b52f-db7ceca0adc8, event_date 2022-10-30T01:06:04.927Z, event_name STORE_EXIT_AUDIT_RESULT, request_source RECEIPT_AUDIT_SERVICE ] message {“receipts”:[{“tc_id”:“20420249182009622534”,“tc_date”:“2022-10-30T01:06:04.927Z”,“tc_store_id”:“92”,“tc_operator_number”:“11”,“tc_register_number”:“11”,“tc_audit_status”:“SUCCESS”,“tc_previously_audited”:false,“tc_previously_audited_date”:null}],“audit_result”:{“audit_date”:“2022-10-30T01:06:03.846Z”,“audit_store_id”:“92",“audit_associate_id”:“103956635",“audit_result”:“Pass”,“audit_failure_reason”:null,“scanned_items_number”:3,“items_found”:[],“items_not_found”:[]}}” ,“traceId”:“”, “spanId”:“”, “parentSpanId”:“”, “traceparent”:“”, “tracestate”:“”, “message_code”:“”, “flag”:“”, “tenant”: “”, “businessKey”:“”, “ringId”:“”, “locationNumber”:“”, “dc”:“”} I want to see Store exit result with operator number, store id, register number , audit result , scanned items number , items found , items not found and also audit date , tc_id, timestamp in a table with those values. can anyone please    ... View more

 Below query is in string text format need to separate each field and create a table with all columns for operator , register , store , timestamp, associate_id, audit_result log: {“timeMillis”:“166665", “timestamp”:“2022-10-16", “level”:“INFO”,“logger”:“com.abc”, “message”:“Business Key=null, Publishing status: [ client_req_id dc366, event_date 2022-10-16, event_name EXIT ], message {“receipts”:[{“id”:“150”, “date”:“2022-10-24”, “store”:“99”, “operator”:“48”, “register”:“48”,“status”:“pass”,}], “result”: {“date”:“2022-10-16",“store”:“99",“associate_id”:“92",“result”:“Pass”,“failure_reason”:null,“scanned_items”:1, “items_found”:[],“items_not_found”:[]}}”   Tried query as spath input= , path= , output= | table id, operator , register, store , timestamp but dont work   ... View more

How can i convert timestamp to date for below timestamp to just date 2022-10-04. timestamp: 2022-10-04 19:52:00.151 -0500 Requirement is to visualize values in last 7 days based on date   ... View more

Hi, How can we calculate milli seconds to seconds for this field -> transactionDuration=20058? ... View more