Hello,   I am using addcoltotals command to get the total value of a column and I would like to display the value returned by addcoltotals command in the subject of the email when an alert is triggered.   my_search|chart count AS XXXX by YYYY| addcoltotals labelfield="Total Delivered"   The output is   Files | Files_Count | Total Delivered F1     |     3                   | F2     |      5                  | F3     |      3                  |            |      11               | Total   I would like 11 to be displayed in the subject line. Tried various tokens but could not get it working.   Regards   ... View more

Hello, Currently my search looks for the list of containers which includes initialised successfully message and lists them. The alert I have set is to look for the number of containers under total connections column and if it is less then 28, then some of them did not connect successfully   How can pass I the list of containers in my search and compare that with the result produced and state if the result is missing a container please?     Sorry I cannot provide the exact search on a public forum, so I am sharing something similar.   Example: (my example just shows 4 containers)   The search should return container A, container B, container C, container D   Current search:   index=*  Initialised xxxxxxxxxxxx xxxxxx|rex "\{consumerName\=\'(MY REGEX)"|chart count AS Connections by name| addcoltotals labelfield="Total Connections"     The current result is   Container_Name      |  Count       |    Total_Connections Container A                 |    1              | Container B                 |   1                | Container C                 |    1               | Container D                 |    1               |                                                                                     4            How can I tweak the above search to include container A,B,C and D and if container D is missing in the result, the search should compare the result with the values passed in the search and state which container is missing as the last line in the above table i.e. preserve the existing result but state which container is missing from the result as well please?   Regards ... View more

Hello I would like to count the number of values every time the search matches the string  alternativeIdValue- i.e. after the = count the values separated by ,   alternativeIdValue=IE778898,WX888889,IS89657578,XS76575889.............................................   The length of each value can be different and  the only common pattern is they are separated by comma and they start with an alphabet.     ... View more

Hello, I have the following log   19:02:32.576 [hz.cache-server-2.HealthMonitor] INFO com.hazelcast.int.dia.HM - [X.X.X.X]:5701 [X.X.X.X] [3.11.1] processors=12, physical.memory.total=98.2G, physical.memory.free=12.0G, swap.space.total=0, swap.space.free=0, heap.memory.used=4.3G, heap.memory.free=901.8M, heap.memory.total=5.2G, heap.memory.max=5.2G, heap.memory.used/total=82.96%   And I am looking to extract the latest heap.memory.used/total value for the last 24 hours and display it in radial gauge   Currently I am using the following  index=* "heap.memory.used/total" | rex "heap.memory.used/total=(?<Number>\d+)" | stats latest(Number) as current_cpu_usage | gauge 0,20,40,60,80,100   I expected radial gauge to show the current mem usage i.e. 82.96%, but the speedo is stuttering at 0.   I wonder my extraction of the % field is incorrect. Could someone assist me  here and also how would I display the mem usage percentage in the dial please?   Best Regards, ... View more