I need help to combine line 1 and 2 make it as one regular expression line in SPL query  1.      | rex "(?<object>gov\.usda\.fsa\.[^\s]+)" 2.      | eval object=split(coalesce(object, "NA"),"."),object=mvindex(object,-1)   Please help! ... View more

Hi,   I have been building OS monitoring KPIs for our agency.  As part of this process we defined entities as below   itsi entity mgmt - index=indexname host=*controlm* | dedup host  | eval entity_type=coalesce(entity_type, "controlm") | table host entity_type   it's listing the hosts that are associated to controlm agency.  I am taking entity rule like below Alias is host and matches *controlm* but why my KPIs are not automatically running against these hosts defined in entities? ... View more

Hello,   I am using the Adhoc search below index=indexname tag=oshost host=hostname | timechart span=15min avg(cpu_load_percent) BY host   above adhoc search is giving me what I want in the result but   the generated search below is not providing me the expected result. index=indexname tag=oshost host=hostname | timechart span=15min avg(cpu_load_percent) BY host | `aggregate_raw_into_service(avg, cpu_load_percent)` | `assess_severity(c86ca62b-1055-4aee-8604-bd52d190a4c5, ea57c8b71c4ced13b8c6eedf, true, true, true)` | eval kpi="Control-M service monitoring KPI 7", urgency="5", alert_period="5", serviceid="c86ca62b-1055-4aee-8604-bd52d190a4c5" | `assess_urgency` | `gettime`   I also tried creating the base search with the adhoc query provided above, and configured Threshold Field name as cpu_load_percent. But it's giving N/A on service analyzer and not even getting the results in Aggregate Threshold Values. I am happy to provide more details!   Thanks ... View more