you will get the latest time for each unique value in job_result. Once you get that you need to sort - dev2t. This will give you the latest job result name and also the row with value SUCCESS will give you latest time for success. Can you paste your results here with the above query ... View more

Try this for GET rex field=_raw "GET \W+\w+\S+\d+\W+(?<text>\w+)\?" ... View more

Please try with the above query in my comments ... View more

Are you using this query? index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-TST6/" | stats latest(_time) as tst6t by job_result ... View more

Try form.earliest =$clicked_earliest_date$&form.latest=$clicked_latest_date$ in your link tag ... View more

Can you do this and see if it suffices your requirement- stats latest(_time) as tst6t` by job_result ... View more

you can use rex command to extract the desired text rex field=x "^\S+ (?<text>\w+\s+\d+\s+\w+)" See the example below- | makeresults | eval x="2018/12/09 process 1 successful" | appendpipe [| eval x="2018/12/09 process 2 successful" | appendpipe [| eval x="2018/12/09 process 3 successful"]] | rex field=x "^\S+ (?<text>\w+\s+\d+\s+\w+)" ... View more

Try this :- ME TOO I have the following query I use to get the latest status and time(_time). ‘index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-TST6/" | sort -_time | stats latest(job_result) as status, latest(eval(job_result=“SUCCESS”)) ,latest(_time) as tst6t` ... View more

Any sample data? ... View more

Do the rename for each status code after the chart command- chart count by message.reqHost,message.status| rename "200" as "Success_200", 206 as "206-Partial" .... ... View more

You can do in Settings->fields->CalculatedFields ... View more

If you are hard coding in your query you can use, else store them in a look up and use it in your query to ignore the IP from lookup using a subsearch src_ip NOT IN("xxx.xxx.xxx.xxx","xxx.xxx.xxx.xxx","xxx.xxx.xxx.xxx"....) ... View more

Please accept the answer if that worked for you. 🙂 ... View more

When its passed as token to other panels along with the Owner , there should be no impact of deleting duplicate branch number in your input query as your selection from lookup or index will be based on combination of branch# and Owner. Can you please paste your code so it will be easy to understand the question. ... View more

Try this Calculation for request per minute |eval RequestPerMin = Request / (4 * 60) ... View more

index="wineventlog" host=$EventHost$ | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name |replace "\\" with "\\\\" in server_principal_name ... View more

There should be a | before “where” in your inputlookup query for your multi select customer input ... View more

Please upload your lookup as a csv type and give the lookup name with csv extension like .csv ... View more

The error is not with rex command , it is because you are usinfg [|inputlookup immediately after rex. Try like this index=xxxx* | rex field=url "(?<domain>\w+\.\w+)\\/" | fields domain url [| inputlookup IOCs-URLs.csv | stats values(UrL) as url | format] | stats count as NumOTimes by src_ip,url ... View more

Any sample data for url field? ... View more

Try this index="marketing1" sourcetype="csv" | eventstats sum("Declared Value _USD") as total_sales |stats sum("Declared Value _USD") as sales max(total_sales) as total_sales by "Destination Country Correct Translation"|eval Percentage=sales/total_sales*100 |sort 0 - sales| rename "Destination Country Correct Translation" as Country | sort 0 - Percentage |streamstats count as c | eval Country=if(c>5,"Other",Country) | stats sum(sales) as Sales sum(Percentage) as Percentage max("total_sales") as "Total Sales" by Country ... View more

Try doing a sort on sourcetype receiverId before dedup. What is the output you are getting using above search, you can test it removing where clause and see the values of temp and errors for each receiverId ... View more

index=abc (sourcetype=abc_temp OR sourcetype=abc_errors)| fields sourcetype receiverId billingId device.headwaters.watermark.core.DeviceInfo.receiverId.string | rename device.headwaters.watermark.core.DeviceInfo.receiverId.string AS receiverId | dedup sourcetype receiverId|stats count(eval(sourcetype="abc_temp")) as temp, count(eval(sourcetype="abc_errors")) as errors by receiverId| where temp=errors ... View more

Did you check if you are getting any values in ac, just see what below gives you sourcetype=mysource host=myhost* "myClassName" | rex field=_raw "(?<"ac">(?<=wages:).*?$)" | table ac ... View more

You can get latest(_time), the screenshot you shared shows latest(time) as column name. It should be latest(_time) unless you are renaming _time to time ... View more