I am working on a chart that would show all servers with each of their hard drives mapping their drive space over a time period. I would like to get this into a trellis charting where each trellis show the server and each line represents the space free over time. I keep running into problems with this as I can only manage to get a average of the disk space free into each report on each drive. example: Server1 Drives C;D;E;F;Y Server2 Drives C;F;Y;Z Server3 Drive B;C;F;Y;Z My query below gives me all the information I want except that it will not map the drivespace over time - hoping for some help. sourcetype="perfmon:logicaldisk" |bucket _time span=10m | chart avg(Value) over instance by host limit=0 | rename instance as drive ... View more

I am trying to pull out a substring from a field and populate that information into another field. Its a typical URL http(s)://test.my.server/path/pathlook/more/etc?querystring - I have tried rex and other ltrim methods to just pull out the /path/pathlook/more/etc, I want to keep everything from the end of server to the ? My current search is below - with results - Only able to get out the Https:// at this point. Any Suggestions? eventtype=webpageview | eval ReferralURL = cs_Referer | eval "ReferralURL"=mvindex(split('ReferralURL',"?"),0), ErrorURLFlag = if(like(ReferralURL, "%/Error.aspx%"),1,0), ShortReferralURL1 = ltrim(ReferralURL, "https://.") | stats count by cs_uri_stem, ErrorURLFlag,ReferralURL,ShortReferralURL1 | fields , ReferralURL, ErrorURLFlag,ShortReferralURL1 https://afs-sbx-www1.afsdev.work/2010/WebDFIInternal/Interface/DFIFolder/AuditResolutions.aspx 0 afs-sbx-www1.afsdev.work/2010/WebDFIInternal/Interface/DFIFolder/AuditResolutions.aspxtutionSearch.aspx 0 afs-sbx-www1.afsdev.work/2010/WebDFIInternal//Interface/DFIFolder/InstitutionSearch.aspx ... View more