I am trying to write a search query as part of our alerting.  The intention is that if search results come from a certain container (kubernetes.container_name) e.g. service1, service2 or service3 then I should set a priority of 2. The problem is that the service names have a version number appended to them e.g. service1-v1-0 or service3-v3-0b to give two such examples. My intention was to use a combination of 'if' and 'match' with a wildcard to achieve this but it doesn't seem to work.  The reason for me using this was that the start of the container_name would remain the same and as the version numbers change the search that I'm attempting to write should be future proofed. | eval priority = if(match(kubernetes.container_name, "^service1-v*|^service2-v*|^service3*"), "2", "Not set") However these are returning "Not set" even when the expected kubernetes.container_name is used. Can someone help me understand why this isn't working, how to fix and whether there might be a better way of doing this? Thanks! ... View more

Hi, I'm after some assistance. I am trying to capture the peak number of concurrent users in a single minute block using timecharts.  I can do this one minute blocks no problem.   Where this gets complicated is that I have been given the requirement that I should be able to change the timechart span from 1m to 1h and identify the peak minute with the highest number of users within each hour (if hour selected) and display the number of users for that peak minute (frather than the peak number of users for that hour). Can anyone assist me with this, or advise if it's even possible? Thanks ... View more