2019-12-03 17:31:27.633 INFO ,aabbe872bbf3f848,aabbe872bbf3f848,false] 15 --- [nio-8080-exec-5] c.u.f.p.api.impl.: InfoLogging Operation=MakePayment, RequestSourceCode=ZBL, PaymentResponse=class PaymentResponse { responseCode: AB0000 responseMessage: Declined - Do not Honor orderId: 269107641 } This is just n example . With the rex query I want to list all codes with respMessage Below rex Query gets me respCode and respMessage part as only "Declined" rex field=msg "responseCode: (?.[a-z0-9A-Z_-]+)"| rex field=msg "responseMessage: (?.[a-z0-9A-Z_-]+) ... View more

XYZ JACK 479 Cannot update Employee record 10300458578837 Above data is in XML format and I need to get below result 1) Extract field values and display those values as responseTypeCode requestSourceCode responseMessage correlationId. 2) Get the count based on requestSourceCode,responseTypeCode,responseCode ... View more

Hi, I need help with building query which compares value from 2 different search and trigger alert if count from both the query is less than 1 For e.g. index=query1| stats count as count1|appendcols [search index=query2 | stats count as count2 ]|eval final_count=if(matchcount1,count2),"0","1") | stats count AS final_count Current alert condition as : If number of results is less than 0 and schedule cron runs at every 5 mins But my current query triggers alert even if count matches from both the query and it shows final_count value as 1 .. I am expecting alert to be triggers only if count does not matches between both queries and specially in case of counts from both queries result zero after compare. Appreciate you help with correcting to reframe my logic and build query and trigger condition ... View more

How do I add meaningful labels to error codes? index=akamai_pi_prod message.reqHost=*rpama* message.status IN ("200","201","204","206","302","304","403","404","500","502")|rename message.status="200" as "200-Success"| chart count by message.reqHost,message.status Current Result With above query message.reqHost 200 206 304 502 xyz.com 12568 23000 100 56 Expected Result: message.reqHost 200-Succes 206 -Partial Content 304-Cache 502-Bad Gateway xyz.com 12568 23000 100 56 Appreciate your help on this Thanks, Harish ... View more