Hey, I am trying to retrieve the events based on the selected values from the Statistics table IBD TOTAL SUCCESS FALED MAXRESPONSE MINRESPONSE AVGRESPONSE IBD1 1149 1149 0 19432 693 1772.423847 IBD2 250 230 20 16532 18 2382.612000 IBD3 161 161 0 13801 741 1950.329193 IBD4 129 128 1 7395 45 2132.674419 IBD5 113 113 0 6324 825 1728.646018 index=* sourcetype=VM_STATS | stats count as TOTAL, count(eval(Status="SUCCESS")) as SUCCESS, count(eval(Status!="SUCCESS")) as FALED , max(TimeTaken) as MAXRESPONSE, MIN(TimeTaken) as MINRESPONSE, avg(TimeTaken) as AVGRESPONSE by IBD | sort 10 -SUCCESS For Example if I select the MinResponse Value for the IBD1, it should return that particular event alone instead of returns all the Events listed under IBD1. Is it possible to retrieve the events based on the selected values. ... View more

Report to show the Top 10 Max values I want the Report as below IBD successcont Mintime Maxtime IBD1 2 3000 11071 IBD2 2 2678 2265 etc index=* sourcetype=VM_STATS ( Status=SUCCESS ) | stats count, max(TimeTaken) as max, MIN(TimeTaken) as MIN, avg(TimeTaken) as avg by IBD i want to list the top 10 max values to be retrived.... can you please advice ... View more

I'm having problem with a multi-line field extraction which I have been struggling to figure out. Below the log files .. 2018-01-02T13:24:30,503|[http-nio-8181-exec-4]|INFO|VM1|DocumentUploadRestController|DE0F4345165F89085E86221B49F86C02|5fac4fca-3dda-4f56-ac9d-f46889badcc9|TESTC01|Normal|A01|11071|1658049|147213323|null|SUCCESS|ImageByte 2018-01-02T13:28:19,420|[http-nio-8181-exec-7]|INFO|VM2|RestController|9E6D1D1CCEB59143C66A3A3FBC050692|5c191357-c436-4577-8896-ab983997cb65|1323574285.736696.48319626.2018167121.17362971%40-1983397168.17368709|TEST02|Normal|A02|2265|14388|147213326|null|SUCCESS|Multipart 2018-01-02T13:08:06,661|[http-nio-8181-exec-8]|INFO|VM3|DocumentUploadRestController|59BC5ADE721BF054A874FF6EF735E71D|46ca1a17-f35f-4193-9192-cc6c8d66d219|-603590707.736696.46257691.1596685263.27318499|TEST03|Normal|A03|18|264360|null|null|Invalid error message Number|Multipart i m trying to extract the Fields Date, VM, and from user id (TEST01,TEST02) all the fields. for the first line is not matching with other 2 lines.. so i m trying to get the details sing below query but i m not getting Proper Result. ^(?P[^|]+)[^]\n]]|\w+|(?P\w+)(?:[^|\n]|){5}(?P[^|]+) for the first line instead of user id TESTC01 its extracting next vale as "Normal". Can yo please help me to extract the fields for the uneven lines log files ... View more