How many values are allowed in an IN clause which is part of where clause? I want to read 277 values to be precise. index=abc sourcetype="ccinfrap.dc_pqr_jws:app" "[SubscriptionService] Consumer sent message" "Not Predicted to Finish" | rex mode=sed "s/^.*message {/{/" | rex mode=sed "s/\n}.*/\n}/" | spath | fillnull jobStreamName value="BLANK" | where jobStreamName IN( "stream1" ,"stream2" ,"stream3" . . ,"stream277" ) ... View more

  I need a list of only those jobName which start with letter a though m - anycase. The below does not work index=log-13120-nonprod-c laas_appId=qbmp.prediction-engine sourcetype="qbmp.prediction-engine:app" "predicted as Prediction" | table jobName | dedup jobName | where jobName like "[a-m]%"     sample event is like this below     08-06-2022 10:19:36.990 [task-53] INFO c.m.b.p.service.PredictionWorkerV2#run - predictionId=1e5a96c6-5f90-4bf9-b0df-7f3528ae642b, threadId=23, job=SRW-REPAPER-LoadedStatus^QNA predicted as Prediction{predictionId='1e5a96c6-5f90-4bf9-b0df-7f3528ae642b', jobName='SRW-REPAPER-LoadedStatus', instance='QNA', predictionStatus='cant_predict', predictedStartTime=-1, predictedFinishTime=-1, predictionExplanation='no_jobstats', predictedAt=1654697976}     The above event has jobName='SRW-REPAPER-LoadedStatus' and it does not start with a letter from a through m. So it should not be displayed. ... View more

Hi All, I have a SPL query that runs on an index , sourcetype which has milions of jobnames. I want to my SPL to read through a list of jobnames from a different query and use it as subsearch  OR I have created a lookup.csv for this 16,000 list of jonames and want to run my search on it.   How to do that ?   Main SPL that runs on millions of jobnames : earliest=-7d index=log-13120-nonprod-c laas_appId=qbmp.prediction* "jobPredictionAnalysis" prediction lastEndDelta | table jobname, prediction_status, predicted_end_time Below is an input lookup  freq_used_jobs_bmp_3months.csv which is a simple two columnar file  jobName, freq_count     I tried to join main query with this inputfile. I want to operate and write SPL queries on this list of jobNames only.     earliest=-7d index=log-13120-nonprod-c laas_appId=qbmp.prediction* "jobPredictionAnalysis" prediction lastEndDelta | table jobname, prediction_status, predicted_end_time | lookup freq_used_jobs_bmp_3months.csv jobName output freq_count |table jobname, freq_count The above query fails with error  na_prod_secure-ist-indexer-1_iapp724.randolph.ms.com-23000] Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'freq_used_jobs_bmp_3months.csv, jobName, output, freq_count'. See search.log for more details I removed any null rows in the file.  Still I get the same error. Other option is to somehow combine, join main query with a sub search instead of a lookup file. main query  earliest=-7d index=log-13120-nonprod-c laas_appId=qbmp.prediction* "jobPredictionAnalysis" prediction lastEndDelta | table jobname, prediction_status, predicted_end_time sub search that will list a smaller number of jobNames that are used in last 3 months : earliest=-90d index="log-13120-prod-c" sourcetype="autosys_service_secondary:app" OR "autosys_service_primary:app" "request:JobSearch" installation="P*" NOT"*%*" | stats count as freq_count by jobName   Now how to join the above two?     ... View more

How to find the duration in minutes between two events from _time ?   index=log-13120-nonprod-c laas_appId=qbmp.prediction* "pushed to greenplum for predictionId" 2022-05-19 03:37:30,108 jobRunStats INFO Current Predictions, total=1659262 pushed to greenplum for predictionId = fe387967-2f11-4358-8b27-c51a45042e79 2022-05-19 03:26:29,085 jobRunStats INFO Current Predictions, total=1659262 pushed to greenplum for predictionId = 473866d5-c7b1-4156-90a0-de978b260e8d   I simply want diff between the above two and then show a line graph of cycle time length in minutes. So then output will be  11mins 14mins 7 mins  And then I want to plot a line graph that will tell me length of my cycle time    I do not want to use transation ... View more