You can also use:    NOT (host IN (*castle*,*local*))   So full query will be something like this:  sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" NOT (host IN (*castle*,*local*)) ... View more

@JyotiP Please check my UPDATED answer. ... View more

@skrajkumar_splunk thanks for sharing the query, I have just modified the positions and it fulfills my requirement, host=localTest sourcetype="perf" Path "/api/*/" cache="MISS" OR cache="HIT" | chart count over Path by cache Or host=localTest sourcetype="perf" Path "/api/*/" cache="MISS" OR cache="HIT" | stats count(eval(cache="MISS")) AS MISS count(eval(cache="HIT")) AS HIT by Path ... View more

Here is an example from some different data: sourcetype=access_combined earliest=-60m | bin _time span=10s | timechart count by action You might consider using Trellis visualization as well, which automatically creates a different line graph for each. ... View more

Check out extended examples number 2 & 3 here: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Spath You need to spath, rename, zip, and then mvexpand. It's tricky but well documented. Follow the steps. ... View more

Getting the below error, Error in 'rex' command: Encountered the following error while compiling the regex '\/api\/(?\w+)\/(?\w+)\/(?\w+)': Regex: unrecognized character after (? or (?- ... View more

the problem with your code is when you do an avg(count) in stats, there is no count field to do an average of. if you do something like - |stats count as xxx by yyy|stats avg(xxx) by yyyy you will get results, but when you try to do an avg(count) in the first stat, there is no count field at all as it is not a auto extracted field. assuming you are running the query for the last 7 days, you can try this | timechart span=7d avg(count) as avg_count by PartnerToken ... View more

thank you so much for the clarification, @jpolvino and so as well @Adrian_ftx ... View more

Hi Try the below method, as per your sample data Message are in JSON format. so I used spath to extract the info [updated:] | makeresults | eval test="Level=\"INFO\", Date=\"2019-07-22 08:43:44,141\", Message=\"{\"Protocol\":\"https\",\"Path\":\"/api/infrastructure/qualitygate/v1/qualityGateStatus\",\"Verb\":\"GET\",\"QueryParams\":{\"component\":\"help-website-stack\",\"version\":\"1.0.291\",\"environment\":\"testenvironment\",\"componentType\":\"stack\"},\"body\":{},\"StatusCode\":200,\"Details\":{\"component\":\"help-website-stack\",\"version\":\"1.0.291\",\"sonarStatus\":true,\"integrationTestStatus\":true,\"status\":true,\"message\":\"\",\"coverage\":\"0.0\",\"newCoverage\":\"0.0\"}}" | rex field=test "Message\=\"(?P<Message>.*)}}$" | spath input=Message path=QueryParams.component output="Component" | spath input=Message path=QueryParams.environment output="Environment" | spath input=Message path=QueryParams.componentType output="Component Type" | spath input=Message path=Details.newCoverage output="New Coverage" | table Component Environment "Component Type" "New Coverage" ... View more

Try this: | rex field=_raw "Completed executing query (?<Procedure>.*?) which took" ... View more

@JyotiP, you can try the following regex <YourBaseSearch> | rex "\"FirmName\":\"(?<firmName>[^\"]+)\"" However, seems like you have JSON data, so it is better if you try rex to get complete JSON Data packet and then apply spath command. You should also try out couple of props.conf properties like INDEXED_EXTRACTION=json and/or KV_MODE=json ... View more

Try something like this. It will show the current Value for each host. host=aeperf* index="perfmon" collection="CPU" counter="% Processor Time" | bucket _time span=15m | stats avg(Value) as avg_CPU by host | where avg_CPU>=60 If you want to see the Value over time, try this. host=aeperf* index="perfmon" collection="CPU" counter="% Processor Time" | bucket _time span=15m | timechar avg(Value) as avg_CPU by host | where avg_CPU>=60 ... View more

@harsmarvania this worked. Thank You ... View more

Hi I know it's too late to answer but I would like to contribute the following idea: |rex ".businessDate=(?\d.-\d*)\.closeoutSchemeId=(?\d\u\d).positionStateId=(?\d)" ... View more

@niketnilay, thanks for the update, will try the above. ... View more

@DalJeanis can create a pi chart or graph for the above query ?? ... View more