Maybe because you are windows, the problem is the path so instead of this: DATETIME_CONFIG = /etc/apps/search/datetime.xml Try this: DATETIME_CONFIG = \etc\apps\search\datetime.xml ... View more

Thankyou very much ... View more

Hi nitesh218ss Try with this xml code search index="uk" sourcetype="ukpro" serviceType=1 message="Deleted m_pReceivingSocket" | rename time as time2, message as Responce | stats count as req|appendcols[search index="uk" sourcetype="ukpro" serviceType=1 message="Received * bytes from IP*" | rename time as time1,message as Request] | eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime | table time2 time1 TimeDiff audit Request Responce req | stats avg(TimeDiff) as AVG, max(TimeDiff) as MAX, min(TimeDiff) as Min,count(Responce) ... View more

thanks sir ... View more

ok sir thanks ... View more

i use this way they run but in result how i get in result they show field result and count(audit) only not show sub query count my query is: | eval ll=substr(message,0,18) | where ll="getLogMsg returned" | rex field=message "^71^+(?<myAp>[^^]+)^" | eval result=if(myAp = 00,"sucess","fail") | join audit [search index="uk" sourcetype="uk18" serviceType=1 | dedup audit|fields + audit | eventstats count as kk ] |stats count(audit) by result ... View more

i understand properly thanks sir ... View more

i give a solution of this problem please see answer 3 But at time of indexing i use LINE_BREAKER they work correctly but when i add FIELD_DELIMITER = | FIELD_NAMES = timee,audit,serviceType,processId,serviceName,indicator,status1,status2,status3,status4,status5,status6 the line break not work? ... View more

i try this but not work Many way i try to change props.conf but not work [line_try] FIELD_DELIMITER = | FIELD_NAMES = datee,timee,no1,no2,msg1,msg2 INDEXED_EXTRACTIONS = csv KV_MODE = none LINE_BREAKER = ([\r\n]+)\d+\/\d+\/\d+ NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true or [line_try] FIELD_DELIMITER = | FIELD_NAMES = datee,timee,no1,no2,msg1,msg2 INDEXED_EXTRACTIONS = csv KV_MODE = none BREAK_ONLY_BEFORE = ^(\d\d\/\d\d\/\d\d\d\d) BREAK_ONLY_BEFORE_DATE = True NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true or [line_try] BREAK_ONLY_BEFORE = ^(\d\d\/\d\d\/\d\d\d\d) FIELD_DELIMITER = | FIELD_NAMES = datee,timee,no1,no2,msg1,msg2 LINE_BREAKER = ([\r\n]+)\d+\/\d+\/\d+ NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Custom disabled = false pulldown_type = true After change i restart every time but they not work ... View more

When i use this search with EXTRACT-myfield = (?:[^x1d]x1d){1}(?:[^x1c]x1c){2}([^x1cx1d]) in Msg in props.conf. After that I ran this search: index=myrr | rex field=_raw "(?:[^x1d]x1d){6}(?:[^x1c]x1c){10}(?[^x1cx1d])" Then i got my field thank you ... View more

Yup! Good job. ... View more

ok but db2 is only support by java8 that y i use db1 ... View more

Hi in my log event and filename date is not present i want give a fix date to log so what is do ? ... View more

Hi in my log event and filename date is not present i want give a fix date to log so what is do ? ... View more

Hi in my log event and filename date is not present i want give a fix date to log so what is do ? ... View more

This disables the all time from presets, but you can actually do an all time search if you update earliest time in advanced to 0. ... View more