thanks @inventsekar  it solved! ... View more

  .........base search here......... |end_time = 2024-09-24 08:17:13.014337+00:00 |eval end_time = strptime(end_time_epoch, "%Y:%m:%d %H:%M:%S") |eval _time = now() |eval time_epoch = strptime(time_epoch, "%Y:%m:%d %H:%M:%S") |eval diff = (time_epoch-end_time)/60 ... View more

I'm trying to calculate the minute difference between two times and get an empty field   .........base search here......... |eval end_time = strptime(end_time_epoch, "%Y:%m:%d %H:%M:%S:%N") |eval time_epoch = strptime(now(), "%Y:%m:%d %H:%M:%S") |eval diff = (end_time-time_epoch)/60   ... View more

hi I have a similar problem Tried this solution and I get an empty field   |eval end_time = strptime(end_time_epoch, "%Y:%m:%d %H:%M:%S:%N") |eval time_epoch = strptime(now(), "%Y:%m:%d %H:%M:%S") |eval diff = (end_time-time_epoch)/60 @Richfez    ... View more

I note that it does not alert the field that does not exist, When I make another file that doesn't have the field, it does warn ... View more

Hi @manjunathmeti  thanks for reply I tried OUTPUT and its the same behavior ... View more

In the CSV file I have id, system, time_range, count_err I received a ready dashboard that monitors the DAGS from the AIRFLOW I am interested in creating for each DAG its own alert with the same logic of the dashboard only with a small change, in the dashboard I mark success if it returned from the AIRFLOW logs success in a time frame I gave the same field in the CSV file and ERROR if it did not return success or returned FAILED, In the alert, I want that if I receive faild as the number of times listed in the CSV file or if it does not return success at the time_range I specified in the CSV file, that it be ERROR The dashboard is taken from the file with the syntax of    [|inputlookup xxx.csv .....] |lookup xxx.csv dag_id OUTPUTNEW system time_range   And I want to add a field   |lookup xxx.csv dag_id OUTPUTNEW system time_range count_err   And I don't know why the extra field is not displayed   ... View more

hi  5 columns and 79 rows ... View more

5 columns and 79 rows ... View more

yes  it is a values for id in my events ... View more

Hi @ITWhisperer  Thenks for reply count_err is exist in xxx.csv I forgot to mention that when I do that it does appear [inputlookup xxx.csv |search dag_id=**** |table system, time_range, count_err] but I have to do that in lookup Thank ... View more

Yes I want it to color the entire row if the importer_in_csv = 0 ... View more

this is my search: |search index=****** interfaceName=* |stats values(interfaceName) as importer |join type=lest [|search index=****** Code=* [|inputlookup importers.csv |table interfaceName] |lookup importers.csv interfaceName OUTPUTNEW system timeRange |where like(system, "%") |stats values(system) as reality values(timeRange) as max_time |eval importer_in_csv=if(isnull(max_time),0,1) I want to color the importer column if importer_in_csv = 0 How do I do it in XML? thanks!! ... View more

@gcusello  I want all records that not in csv ... View more

Hi @gcusello  thank you for your quick response I have two lists 1. importers - includes many importers  2. importers_csv - contains some of the importers from the first list I want a list which will contain the importers that are not in the CSV file How to do it?   ... View more

| stats count(eval(like(message, %READ-ERROR -> DP is temporarily down%))) as read_error_count |stats count(Code) as count_by_id |eval color_value = if(read_error_count > count/2 ,0,1) i want color read_error_count column by color_value result thanks @ITWhisperer  ... View more

It's not exactly the same question. My question is how do I color a field according to another field The query looks like this: <query> stats count(Code) as count_by_id count(eval(like(message, %READ-ERROR -&gt; DP is temporarily down%))) as read_error_count </query>   And I want to color the read_error_count column according to the count_by_id variable How do I do this in XML? <option name= "count">13</option> <option name= "dataOverlayMode">none</option> <option name= "drilldown">row</option> <option name= "wrap">true</option> <format type = "color" field= "read_error_count"> <colorPallete type="list"> <colorPalleteEntry></colorPalleteEntry> </colorPallete> </format>   Thank you @ITWhisperer  ... View more

but I have 2 fields, and I want to color the first field according to the value of the second field- if true then color it red. the fields are defined as eval in query.  thank you ... View more