I need to add the hosts to the search below, such as host = "servername" . It currently brings up all the hosts in the index and I only need a few. | metadata type=sources index=myindex | join source type=outer [ search index=myindex AND fullload = "]I: Task is running" | bucket span=1h _time | stats count by source, fullload | eval Date=strftime(_time,"%m/%d/%Y")]| sort + count| fillnull value=0 |where count = 0 |search TaskName = "*_T1" |fields TaskName, count ... View more

It always brings up no results. Here is my query: index=abc host = "123" OR host = "456" OR host = "789" OR host = "012" fullload = "]I: Task is running" | stats count by source, fullload | where count < 1 It is looking for this message: "]I: Task is running" can you please help ... View more

I am looking for help with a case statement that looks for a field full load with a value of "running CDC only in fresh start mode, starting from log position: 'timestamp:", and if full load doesn't find that then other is used. index=sse_gdia_local_idx "starting from log" |eval fullload = case("running CDC only in fresh start mode, starting from log position: 'timestamp:", trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")) and trim(replace(fullload, "T", " ")) and trim(replace(fullload, "'", " ")) and |eval c_time2=strptime(fullload,"%Y-%m-%d %H:%M:%S") -14400 and c_time2 = strftime(c_time2,"%Y-%m-%d %H:%M:%S"), other|convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS c_time2) |fields fullload, c_time2 ... View more

This is what I tried. The query runs but the hours are not removed. index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=relative_time(fullload, "-14400s") |eval c_time2=strftime(strptime(fullload,"%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S") ... View more