HI Team, Need one help, I want to run a schedule for the below search events  every 1 hr and capture the inportant fields  like responseStatus, r equestMethod,  requestURL, servicePath, Total request, hour, day,  etc. and  write to outputfile in csv. So that I can use this report for my dashboards.  The idea behind this is becase, our application logs millions of events per day and if we want to look for the historical data for reports, it takes long time to run and load the dashboard. I want to run this every hour and append the data it in the existing csv file. I tried the lookup but didn't work for me. Any solutions welcome time=2021-04-14T17:57:07 + 00:00 requestId=751411798490203 traceId=751411798490203 servicePath= " /ecp/ " remoteAddr=71.74.45.8 clientIp=24.161.128.196 clientAppVersion=NOT_AVAILABLE app_version=- apiKey=72c07648-ea14-34f2-abed-e38263580b5c oauth_leg=2-legged authMethod=oauth apiAuth=true apiAuthPath=/ecp/ oauth_version=1.0 target_bg=default requestHost=api.spectrum.net requestPort=8080 requestMethod=GET requestURL= " /ecp/entitlements/v2/entitlements ? divisionId=NEW.004 & accountNumber=28290420 " requestSize=560 responseStatus=200 responseSize=8422 responseTime=0.025 userAgent= " IPVS " mapTEnabled= " F " charterClientIp= " V-1 | IP-24.161.128.196 | SourcePort- | TrafficOriginID-24.161.128.196 " sourcePort= "" oauth_consumer_key= " 72c27648-ea14-44f2-abed-e38263580b5c " x_pi_auth_failure= " - " pi_log= " pi_ngxgw_access " ... View more

HI, I need to get the count of all the packages from the json body and display the total no of packages available for that transaction [" 143 "," 144 "," 172 "," 205 "," 241 "," 350 "," 364 "," 365 "," 385 "," 449 "," 486 "," 683 "," 764 "," 1043 "," 1220 "," 1241 "," 1287 "," 1309 "," 1381 "," 1432 "," 1456 "," 1509 "," 1578 "," 1641 "," 1727 "," 1753 "," 2835 "," 3299 "," 3309 "," 3566 "," 3626 "," 3897 "," 4127 "," 4349 "," 4456 "," 4805 "," 4835 "," 4870 "," 4872 "," 4890 "," 4954 "," 5254 "," 5485 "," 5486 "," 5487 "," 5488 "," 5489 "," 5490 "," 5491 "," 5492 "," 5493 "," 5494 "," 5495 "," 5496 "] Log: [ 2020-07-31 07:58:47 , 906 ] [ INFO ] [ http-nio-8080-exec-31 ] [ txnId=1596182327895-1558302899 ] [ clientIp=172.27.159.170 ] [ accountNumber= ] [ charterId= ] [ sessionHashCode= ] [ methodPath=/services/v2/entitlements/packages/ { macAddress } :GET ] TxnLogging - [ txnmarker=TXNEnd ] [ timestamp=Fri Jul 31 07:58:47 UTC 2020 ] [ application=/lrmmiddle/ ] [ methodPath=/services/v2/entitlements/packages/ { macAddress } :GET ] [ duration=11 ] [ clientIp=172.27.159.170 ] [ entity=Response Status:200 ] [ txnId=1596182327895-1558302899 ] [ status=200 ] [ responseJson= {" macAddress " : " 3438B79C5638 "," blockAll " :false ," packages " : [" 143 "," 144 "," 172 "," 205 "," 241 "," 350 "," 364 "," 365 "," 385 "," 449 "," 486 "," 683 "," 764 "," 1043 "," 1220 "," 1241 "," 1287 "," 1309 "," 1381 "," 1432 "," 1456 "," 1509 "," 1578 "," 1641 "," 1727 "," 1753 "," 2835 "," 3299 "," 3309 "," 3566 "," 3626 "," 3897 "," 4127 "," 4349 "," 4456 "," 4805 "," 4835 "," 4870 "," 4872 "," 4890 "," 4954 "," 5254 "," 5485 "," 5486 "," 5487 "," 5488 "," 5489 "," 5490 "," 5491 "," 5492 "," 5493 "," 5494 "," 5495 "," 5496 "]," statusCode " :null ," header " : {" status " : " SUCCESS "," transaction " : {" statusMessage " : " 0 "," returnCode " : " 0 "," returnMessage " : " 0 "," exception " :null ," id " : " 1596182327895-1558302899 "," dateTime " : " 2020-07-31T07:58:47.906Z "," duration " :11 ," hostname " : " lrmmiddle-f56fd7d48-s2r4l "}," sourceTransaction " :null }}] ... View more

Hi, Need one Help. I have the below mentioned requestPath where  I am able to capture the whole path..But can't take a count if there is different Div ID and Account No. I just to extract only "/ecp/stream/v1/purchase/" and make a count of it. so that I can get the different response status "requestPath":"/ecp/stream/v1/purchase/NTX.8160/8260180902213447","responseStatus":204,"responseSize":0,"responseContent":"","responseTime":27} Show syntax highlighted rex field=_raw "requestPath":"(?<reqPath>[^?|^\s|^"]+)" ... View more