How can I find the avg duration trend (timechart) of top 5 (most used) api above 5 seconds. If api has the same total calls, pick the highest duration. This is what I have so far.     <Search string> | bin _time span=1m | eventstats count as total by api | stats avg(kpi_value) as duration by _time api total | where duration >5 | timechart eval(round(avg(duration),2)) as avg_duration by api where total in top5 limit=0       ... View more

  I could retrieve the list of the transactions as a single event below. Transactions start with "Dashboard Load:" and end with "Total Dashboard Load Time"   | rex "Account: (?<account>[^\,]*), SiteID: (?<siteID>[^\s]*) - (?<duration_in_ms>[^\s]*) milliseconds on Requestor: (?<requestor>[^\,]*)" | transaction agent endswith="Total Dashboard Load Time" | eval duration_in_sec=round(avg(duration_in_ms)/1000,2) | table agent account siteID flow duration_in_sec     I could find the delta between each event as multiple events with below   | rex "Account: (?<account>[^\,]*), SiteID: (?<siteID>[^\s]*) - (?<duration_in_ms>[^\s]*) milliseconds on Requestor: (?<requestor>[^\,]*)" | streamstats current=f last(_time) as last_time2 by agent | rename _time as current_time2 | eval delta= last_time2 - current_time2 | eval last_time =strftime(last_time2, "%m/%d, %H:%M:%S.%6N") | eval current_time =strftime(current_time2, "%m/%d, %H:%M:%S.%6N") | table agent account siteID flow duration_in_sec last_time current_time delta     I'm looking to see if I can find a delta between events in a single transaction. The transaction starts with "Dashboard Load" and ends with "Total Dashboard Load Time" Expected Result Format:   agent, account, siteID, list of flow (all 5 Dashboard Load actions), duration_in_sec, list of event times, list of delta between event time   agent - the name of the agent account - account # siteID - site# list of flow - all action flows durations_in_sec - Total Dashboard Load Time list of event times - List showing all event time list of the delta between event time - List showing 4 delta times between each flow   Below are a sample of 2 data of 5 events   2021-12-16 05:30:43,834 alpha - Dashboard Load: User Clicked on New 2021-12-16 05:30:46,498 alpha - Dashboard Load: User Clicked on AccountSearch 2021-12-16 05:31:05,420 alpha - Dashboard Load: User Clicked on Search with String abcdef 2021-12-16 05:31:08,557 alpha - Dashboard Load: User clicked on Searched Result 123456 2021-12-16 05:31:12,234 alpha - Total Dashboard Load Time for Account: 000111222, SiteID: 123- 3438.0 milliseconds on Requestor: xoxoxo      ... View more

How can I compare if worldTime happened before helloTime by combining the below 2 searches?       index=search Type=Hello | stats first(Time) as helloTime by Account WorkOrder index=search Type=World | stats first(Time) as worldTime by Account WorkOrder           Expected Column Result: Account WorkOrder list(Type) list(Time) worldBeforeHelloFlag       ... View more

Hello, Ignoring commas and spaces, how do I grab just the name string from the below log? Below regex kept returning the value of FirstName. It's not seeing name as "Name=", but as "*Name=*". Regex:   "Name=(?<nameCaptured>[^\,]*)"   Log:   FirstName=Hello, LastName=World, Name=HelloWorld, Address=NoAddress   ... View more

Hi, How can I find in between duration between three transaction event? For example, the duration1 between mod1 and mod2, and duration2 between mod2 and mod3. My current query is taking a while because I'm appending two searches. how can I improve it Ex: user type time user1 mod1 10:00 user1 mod2 11:00 user1 mod3 13:00 Expected result user durationMod1Mod2 durationMod2Mod3 user1 1 hour 2 hours Current code: base search ... | transaction user startswith=eval(status="mod1") endswith=eval(status="mod2") | rename duration as duration1 | append [base search ... | transaction user startswith=eval(status="mod2") endswith=eval(status="mod3") | rename duration as duration2 ] | stats values(duration1), values(duration1) by user ... View more

How can I create a regex query up to a Specific word? For example, the specific word below is "Index". Example data: 1. ... Retirement Priority Index ... 2. ... Working Priority Index ... 3. ... Test Priority 1 Index ... Current regex : | rex "(?<priority>[^I]*)" ... View more

A sample set of logs with fieldnames (time, name, and status) from one index=test 1. name=X1 status=FAIL time=7am 1. name=X1 status=FAIL time=7:01am 2. name=X1 status=SUCCESS time=7:02am 3. name=X2 status=SUCCESS time=8am 4. name=X3 status=FAIL time=9am 5. name=X3 status=FAIL time=9:01am 6. List item Current search: index=test | stats count as tryCount by name, status | chart count(status) by tryCount, status Question 1: Count name of tries by status (success, fail, fail+success). Query above isn't exactly accurate because it's ignoring the category that has both fail+success. Expected result: name success fail fail+success X1 1 X2 1 X3 1 Question 2: How do I populate statistics listing all the name where both status=FAIL and status=Success exist? Expected result: name statusList X1 FAIL - 7am, FAIL - 7:01am, SUCCESS - 7:02am Question 3, how do I show list of status for this scenario with row showing name and column showing by _time? Expected result: **name failList successList X1 7am, 7:01am 7:02am X2 8am** ... View more