Have events like below 1) date-Timestamp Server - hostname Status - host is down Threshold - unable to ping   2)  Date-Timestamp Db - dbname Status- database is down Instance status- DB instance is not available    I would need to write Eval condition and create new field description that if field status is " database is down" , I need to add date, dB, status, Instances status fields to description field   And if status is host down, need to add date,server, status, threshold to description field. ... View more

Can some one please help with the regex that can be used to view the below event in tabular format. Event INFO > 2024-02-02 16:12:12,222 - [application logs message]: ============================================== Part 1.    session start is completed Part 2.     Before app message row count    : 9000000                   Before app consolidation row count    :8888800 Part 3.     append message completed Part 4.     After app message flush row count : 0                    After app message flush row count     :1000000 =================================================   How can we use regex and get the fields from above event and show them in table like below parts                   message                                                  count Part 1               session start is completed part 2                 Before app message row count          9000000                                                                                                         8888800 part 3                   append message completed ... View more

I have a data like below Servename     downtime Web1               7 day 2 h Web2                2 h 23 min Web2               20 min Web3.               17 min   Have  severname and downtime fields. Servernames can be same with different donwtime available.   How can I group this by servename by adding the downtimes in to single row of per server. Help us with spl query ... View more