Thank you so much. Took me a whole day to figure it out, but finally did it. Thank you again. ... View more

@guru89044, sorry I missed this question, you should check out following blog for overlaying time series... https://www.splunk.com/blog/2012/02/19/compare-two-time-ranges-in-one-report.html You would want to use multisearch command or appendcol command instead of append. You should also check out timewrap command available from Splunk 6.5 and above. For learning Splunk you can check out Splunk Fundamentals course and some of other free elearning courses on Splunk Education. Splunk Docs and Splunk Dev are good documentation and tutorial sites. You can also check out Splunk How To channel on Youtube and Splunk Blogs. ... View more

@elliotproebstel Thank you very much. Now i can play with dates. Can you please explain me the rex "(?java?.[.\w]+Exception)"? Its listing all the exceptions but when continues exceptions are present in the logs like below, looks like Its considering only first exception and ignoring other 2. So its listing the exceptions which are not unique also. Example : its listing java.util.concurrent.ExecutionException: as unique even though it occured before like this log. logs : (java.lang.RuntimeException: java.util.concurrent.ExecutionException: java.lang.RuntimeException: org.xyz....) ... View more