Should be split by _time of log, should look like this 2021-02-12 00:35:20.820  [Error] ## sample1 bla bla bla 2021-02-12 00:35:20.836  [Information] sample2 bla bla bla 2021-02-12 00:35:30.731 [Information] sample3 bla bla bla 2021-02-12 00:35:31.429 [Information] sample4 bla bla bla 2021-02-12 00:35:31.506 [Error] ## sample5 bla bla bla 2021-02-12 00:35:31.519 [Error] ** sample6 bla bla bla And now i have search like this which displays in same row: index=pkg_prespvm host IN (*) | dedup _raw | transaction host startswith="[Information] STEP = Dummy" endswith="[Information] -- START TRANSACTION --" | rex field=_raw "plate:(?<info>[^,]+)" | rex "\[Error\]\s\*\*\s(?<message>.*)" | rex "\[Error\]\s\##\sGet\sDuuno\sTransaction\s(?<tranok>.*)" | rex "\[Error\]\s\CustNum:\s(?<customer>.*)" | search "Get Transaction NOK --> Payment:OK" | stats count by host _time tranok message customer info | table _time host customer tranok message info ... View more

Thank you in any case 🙂 Do you know how to put messages from Error one after another and not in horizontal view? @kamlesh_vaghela  ... View more

Hi @Kwip , thank you for helping. Problem is this just example i gave, values for country and licensePlate are different in events. So, i need from that row to take only value of license. Thanks ... View more

Hi, thank you for reply. I still didnt solve it 😞 Is it possible to refer only to this log and extract only from there licence? Thank you ... View more

Thank you for quick respond, i already put same rex command but in event there is several places where licensePlate is shown but i want extract only from that exact log mentioned here. Thanks ... View more

I got blanks when i have log like this  [Error] POS Transaction - Result: Validation Rejected, Card Type: Unknown, Transaction Type: DepositPayment, Amount: 0.00 EUR, Card Technology: Unknown, Terminal Id: 11111, Transaction Date Time: , Acquirer Name: , PAN: , MerchantId: , Extra Data: , Error Message: So,maybe proposed solution doesnt take spaces into consideration. Can you help? Thank you ... View more

It works, i forgot to put _raw. I will still keep post open, in case i see other bugs in mentioned log. Thank you ... View more

Thank you for quick respond. Job doesnt have error anymore and its much quicker but i got null values 😞 ... View more

Hello, thank you for feedback. Here is the sample data 2021-02-12 19:00:50.848 [Information] POS Transaction - Result: Ok, Card Type: Ffff, Transaction Type: AaaaBBB, Amount: 123.00, Card Technology: Ttttt, Terminal Id: 010000, Transaction Date Time: 12/02/2021 19:00:45, Acquirer Name: Dummy Data, PAN: 1111xxxxx1111, MerchantId: 123456, Extra Data: [SDD: 111#11DUMMY#11111111#1B1111#1Z1111#, CardType: DummyCompany, FuelCardBrandName: Dummy, FuelCardAliasGPM: xxxxxxxx0000, FuelCardAgesTerminalId: 111111 ], Error Message: Thank you ... View more

To be transormed in something like this (i am really new with rex sintax) | rex field=_raw "\sPOS\sStart\sCardType\:\s(?<CardType>\w+)\,\sTransactionType\:\s(?<TxType>\w+)\,\s" ... View more

Thank you, but problem is that i have other similiar events with Result so i need to specify exactly with this sintax. ... View more

Grazie Giuseppe. Unfornatunately doesnt work proper, its not grouping them. This is my query index=pkg_prespvm "aaxService:NotAvailable" sourcetype = sigma host IN (*) | dedup _raw | eval StartTime=strftime(_time, "%d/%m/%Y %H:%M:%S") | stats count as "NumberErrors" by host,StartTime | where count>=2 And result is null for the last 1 hour time range which is wrong because when i change query into this index=pkg_prespvm "aaxService:NotAvailable" sourcetype = sigma host IN (*) | dedup _raw | eval StartTime=strftime(_time, "%d/%m/%Y %H:%M:%S") | stats count as "NumberErrors" by host,StartTime I see that i have 2 logs per host for last hour   Thank you ... View more

Thank you for quick reply. Actually they are 2 different events. Trick is here that i need to predict if end event will not occur 15 min from start one, i can not wait to see when end will occur if duration lasts more then 15 min. Please if you have some hint i would really be grateful. ... View more