Likely message is not an extracted field then.  Try this to extract from the _raw event | rex field=_raw "transactionTraceIdentification-(?<transactionTraceIdentification>[^\"]+)   ... View more

Please edit your query to use code blocks </> to format it - as it stands is almost impossible to work out what is your query - plenty of strange things in there, including a random K and a plus sign and seemingly missing pipe symbols as well as missing double quotes where they would be expected and stats clauses that don't make a lot of sense.     ... View more

Please use </> block when you are pasting code etc. to aswer/question. Then it don't change/drop any characters! This should work with next options. <fieldset> <input type="dropdown" token="field1"> <label>Env</label> <choice value='_nontest source="testing source"'> TEST</choice> <choice value=' source="prodsource"'>Prod</choice> </input> </fieldset> .... <query> index=abc $field1$ | stats count </query> Another way is replace those choise rows like <choice value="_nontest source=&quot;testing source&quot;">TEST</choice> <choice value="source=&quot;prodsource&quot;">Prod</choice>  Those bot should work for you. ... View more

My SLA calculating  like this 100-(count of duration<30/total count)*100 ... View more

when you create a dashboard it will have a Schedule section as below Click Edit and set the fields as you want.     ... View more

Hi @Sekhar, to have the maximum advantage from a base search you should use a streming command (as stats, or chart, etc...) in the base search itself. If it isn't possible, as in your case, you have to explicit the fields to use in the panels at the end of the base search using the fields command: <search ID=" start event"> <Query> index=x source= xtype application=xapps | fields <fields used in the panels> <\Query> I'll be more detailed if you could share your dashboard code and, please, put it in the using the Add/Insert Code panel. Then don't use spaces in fields and base_search names. Ciao. Giuseppe ... View more

Hi @Sekhar , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

To be honest, your requirement is confusing as you keep changing field names etc. However, does this get you closer to what you are after? (index=x source type=xx "saved msg") OR (index=y source type=y " recived msg") | fields _time manid index | eval received_time=if(index="y",_time,null()) | eval saved_time=if(index="x",_time,null()) | stats min(received_time) as received_time min(saved_time) as saved_time by manid | eval duration = saved_time - received_time | stats count count(eval(duration > 30)) as exceeded ... View more

Hi @Sekhar, please trys this: | rex field=msg "studentinformation\\\"\s+:\s+\\\"(?<studentname>[^\"]*)" that you can test at https://regex101.com/r/GQVTYF/1 Ciao. Giuseppe ... View more

Hi @Sekhar, let me understand, you can correlate events using the id field or there some other corrrelation rule? if you can use id to correlate events, you could try something like this: (index=emp source=empsource " offer letters") OR (index=manager source=manager source " relieving letters") | stats earliest(_time) AS earliest latest(_time) AS latest values(branch) AS branch values(managerid) AS managerid values(empname) AS empname BY id | eval diff =latest-earliest, | eval earliest=strftime(earliest,"%Y-%m-%d %H:%M:%S"), latest=strftime(latest,"%Y-%m-%d %H:%M:%S") Ciao. Giuseppe ... View more

Try this: index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*" | rex field= log " state=(?<state>.*" | eval starttime=_time | table _time,bid,mandid,actionid,state | apppend [ index=y sourcetype=yytype source=y "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*" | table _time manid actionid | eval endtime=_time ] | stats values(*) as * by mandid | eval duration=endtime-starttime ... View more

(index=x source type=xx "saved msg") OR (index=y source type=y " recived msg") | stats values(_time) as time values(actionid) as actionid values(batchid) as batchid min(_time) as _time by manid | eval duration = max(time) - min(time) | bin _time span=1h | stats count count(eval(duration > 30)) as exceeded by _time | eval slapercentagefailure = 100*exceeded/count ... View more

That query is a good start, but I'd use append rather than join for efficiency. Only you can judge if the results are correct or not since you know the data. ... View more

You still have the same question as I asked you the last time you posted about this - which time do you want? The min time or max time? (index=x source type= xx "String") OR (index=y source type=y " string recived") | stats values(_time) as time values(actionid) as actionid values(batchid) as batchid by manid | eval duration = max(time) - min(time)|eval excessive = if(duration > 30, duration, null()) | stats count(excessive) as excess_count avg(excessive) as excess_avg max(time) as _time by manid   ... View more

Then you add calculation based on duration. | eval excessive = if(duration > 30, duration, null()) | stats count(excessive) as excess_count avg(excessive) as excess_avg by manid ... View more