Hello community! I want to extract data from 2 different logs like bellow: Log 1: 2024-04-28 06:38:51 INFO Start auth for accountId=1, ip=192.168.1.1 Log 2: 2024-04-28 06:38:27 INFO Collect response for accountId=1, was: response=FINISH For example for accountId=1 I have 10 logs with "Start auth", I mean 10 attempts of start auth. In second log, for the same accountId I have 1 or more logs with FINISH. I want to make a table like accountId                              Start auth                                      FINISH 1                                                 10                                                       1   Could you helm me with this?  Thank you. ... View more

Hello.  I have logs which contains field "matching" which is a String type. This field contains this kind of information: [firstName, lastName, mobileNumber, town, ipAddress, dateOfBirth, emailAddress, countryCode, fullAddress, postCode, etc]. What I want to do is to compose a query that will return count of a specific search, such as [mobileNumber, countryCode] and display only the fields that contain the above words. I tried this query: index="source*" | where matching LIKE "%mobileNumber%" AND matchingLIKE "%countryCode%" | stats count by matching | table count matching But the answer returns all the possible variants that also contains [mobileNumber, countryCode]. What I want is a count only for all this results   Also I want to create a table with all specific searches I do. I know how to use append, but result is like a stairs, what other solution can be used? Than you!   ... View more

Hello community. I'm trying to extract information from a string type field and make a graph on a dashboard. In the graph, I want to group identical messages. I encounter difficulties when grouping a type of message that contains information about an id, which is different for each message and respectively for each message it returns a separate value. Ex. message: {"status":"SUCCESS","id":"123456789"}. I use this query: "source" originalField AND ("SUCCESS" OR "FAILURE") | stats count by originalField This query groups my fields that contain a FAILURE status, but does not group the SUCCESS ones because they have different IDs. I tried different substrings but it doesn't work. Can someone give me a solution? ... View more