I am using search ...|timechart sum(x) by y but _time is showing as 2014-4-3-T 00:00, but I want the format of _time on the x axis to be 2014-4-3 only. How do I do this? ... View more

I need help in extracting the following fields from a log file: log file has the following fixed format: 2013-08-11 04:00:01: EPS2_DATA= 2600 EPS2_INDEX= 3100 EPS2_LOB_DATA= 1000 DB= 30100 2014-04-13 04:00:00: EPS2_DATA=33267.984375 EPS2_INDEX= 11000 EPS2_LOB_DATA= 11200 DB=67078.984375 In the log, EPS2_DATA is field name and its field value is 2600 and 33267.984375 EPS2_INDEX is field name and its value is 3100 and 11000 EPS2_LOB_DATA is field name and its value is 1000 and 11200 DB is field name and its value is 30100 and 67078.984375 I tried the following regular expression to extract the fields: EXTRACT-EPS2_DATA = [^=\n]*=(?P[^ ]+) EXTRACT-EPS2_INDEX = (?:[^=\n]*=){2}\s+(?P[^ ]+) EXTRACT-EPS2_LOB_DATA = (?:[^=\n]*=){3}\s+(?P[^ ]+) EXTRACT-DB = (?:[^=\n]*=){4}(?P.+) EXTRACT-Start_Time = ^(?P\d+\-\d+\-\d+\s+\d+:\d+:\d+:), But, I am unable to extract the EPS2_DATA properly because it contains an integer value and decimal value. ... View more

I am reading user from lookup file and then searching a search and find the user list from lookup file and giving table as user and status missing or exist in search. please suggest me what should be the efficient way of doing this. ... View more

I have to count no of id but not per day but not repeated same id. I am trying this. index=*|stats count(id) ... View more