For eg:   If one log event has  uniqueId=abc123 with "Wonder Exist here" and for this uniqueId with  "Message=Limit the occurrence" AND "FinderField=ZEOUS" DO NOT exist then that one should not be in result and same in reverse also should satisfy so uniqueId only with log of "Message=Limit the occurrence" AND "FinderField=ZEOUS" should not come in result ... View more

yes, the below query would extract log events from which I am expecting final list of data    index=finder_db AND (host="host1" OR host="host2") AND (("Wonder Exist here")  OR ("Message=Limit the occurrence" AND "FinderField=ZEOUS")) this query will give 2 log events and both events will include uniqueId in it. So for final result I want to have  uniqueId, FinderField as table where uniqueId is listed when both log events have it and also above string exists with the same uniqueId. ... View more

I have used the uniqueId and message in xyseries, but getting that error message for xyseries. I have 2 log events and both will have uniqueId in that event, now I want both log events to be in my result table only when they both have same value for uniqueId. While as per below query it brings even the logs events which do not have same uniqueId or matching message in them. index=finder_db AND (host="host1" OR host="host2") AND (("Wonder Exist here")  OR ("Message=Limit the occurrence" AND "FinderField=ZEOUS")) | table uniqueId, FinderField by uniqueId  | stats values(FinderField) as FinderField, values(FinderField) as FinderField by uniqueId   Host1 and host2 in this query is my servers name where these log would exist. I am searching 2 string in log events, one is "Wonder Exist here" and second is starting with Message=  and both log will have uniqueId which I want to match for both events and bring as 1 single row in result   Hope I am able to explain and thanks for help ... View more

I am getting this error  Error in 'xyseries' command: At least one data field must be specified. Should my initial search provide already a table for stats and xyseries ? Can I put condition for 2 log events that they must match uniqueID? As I do not want to combine 2 log events where uniqueId in both is not matching. ... View more