Hello,
I would like to group together different fields found on different lines, based on a common field that is found on all lines.
Example Log Lines
2014-03-25 13:45:38,003 - [123456789] Incoming Search Request: project=Project01
2014-03-25 13:45:38,003 - [123456789] count=456, executionTime=334
2014-03-25 13:47:31,012 - [987654321] Incoming Search Request: project=Project02
2014-03-25 13:47:31,012 - [987654321] count=8784, executionTime=1145
I would like to create a table from these lines that looks like:
Project | ID | count | executionTime |
---|---|---|---|
Project01 | 123456789 | 456 | 334 |
Project02 | 987654321 | 8784 | 1145 |
Is this possible? The only examples I have found, the values to group are always on every line, where as some of my fields only appear on the first or second line.
Try this
your base search | transaction ID startswith="project=*" endswith="executionTime=*" | table project, ID, count,executionTime
Try this
your base search | transaction ID startswith="project=*" endswith="executionTime=*" | table project, ID, count,executionTime
Awesome! That worked perfectly. Thank you!
I have seen as many as 9 lines for a unique ID, but usually it is only 2 or 3 lines
For one ID, is there only two events or there can be more?