10.179.130.56 - - [14/Apr/2023:01:59:28.233 +0800] "POST /services/broker/phonehome/connection_10.179.130.56_8089_10.179.130.56_MYETKPWSQL002_918B12BB-35AB-452A-BAEB-592395125496 HTTP/1.1" 200 530 "-" "Splunk/8.2.7 (Windows Server 10 Standard Edition; arch=x64)" - 1ms 10.16.36.90 - - [13/Apr/2023:18:27:12.290 +0000] "POST /services/broker/phonehome/connection_10.16.36.90_8089_usseacwsrv190.us.xyz.com_usseacwsrv190_4D304A0A-05E2-483B-B2B5-7CF8A8928B7A HTTP/1.1" 200 24 "-" "Splunk/8.2.7 (Windows Server 10 Datacenter Edition; arch=x64)" - 2ms Hi Everyone  Please help me with the regex to extract the following fields highlighted in bold. ... View more

Hi All, I want chart to be created in the below way. The x-axis needs to have date and time like that. the chart i am able to create is . i tried to do eval strftime to _time but not getting the desired result. The 1st query I tried -  index=unix (source=cpu sourcetype=cpu) OR (sourcetype=vmstat) host IN (usaws135000) | fields _time cpu_load_percent memUsedPct swapUsedPct host | timechart span=1h eval(round(avg(cpu_load_percent),2)) as CPUAvg eval(round(avg(memUsedPct),2)) as MemoryAvg eval(round(avg(swapUsedPct),2)) as SwapAvg by host useother=t limit=0 The 2nd query i tried -  index=unix (source=cpu sourcetype=cpu) OR (sourcetype=vmstat) host IN (usaws1350) | fields _time cpu_load_percent memUsedPct swapUsedPct host | bin span=1h _time | eval _time=strftime(_time,"%a %b %d %Y %H:%M:%S") | stats avg(cpu_load_percent) as CPUAvg avg(memUsedPct) as MemoryAvg avg(swapUsedPct) as SwapAvg by _time ... View more