What is wrong with this search: host="**" source="*BIP*" NOT source="*BIP98*" NOT source="*BIP99*" |eval path=mvindex(split(source,"-"),0) | eval thread=mvindex(split(path,"/"),-1) |search "BIP CONTROL" | search "TASK MODE: 0" | eval EXECUTION_DATE=strftime(strptime(EXECUTION_DATE,"%d %b %Y"),"%Y.%m.%d") | rex "TOTAL\s+ACCOUNTS\s+QUEUED:\s+(?[^,\s]+)" | rex "TOTAL\s+SUCCESSFULLY\s+PROCESSED:\s+(?[^,\s]+)" | rex "TOTAL\s+LOCKED/SKIPPED:\s+(?[^,\s]+)"| rex "TOTAL\s+IN\s+ERROR:\s+(?[^,\s]+)" | rex "MISSING\n\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\n(?[^,\s]+)" |stats sum(total_accounts) as Total_Accounts,sum(processed) as Total_Successful,sum(skipped) as "Total_Skipped",sum(error) as "Total_Error" by Bill_run,EXECUTION_DATE | where Bill_run like "%M%" | appendcols [search host="****" sourcetype="kenan_pst" | where source like "%pst_pe_arb_bil_run_bip%" | eval date=mvindex(split(mvindex(split(source,"/"),-1),"_"),6) | stats earliest(_time) as first_event latest(_time) as last_event by source ,date | eval first_event=strftime(first_event,"%H:%M:%S") | eval last_event=strftime(last_event,"%H:%M:%S") | eval time_diff=strptime(last_event,"%H:%M:%S") - strptime(first_event,"%H:%M:%S") | table time_diff date] | table Bill_run EXECUTION_DATE Total_Accounts Total_Successful Total_Skipped Total_Error time_diff date ... View more

host=*****| eval Time="17:00:00"|eval Time2="13:00:00" |eval Time=strptime(Time,"%H:%M:%S") |eval Time2=strptime(Time2,"%H:%M:%S") | table Time Time2 is giving the epoch time as Time :1503327600.000000 Time2 :1503399600.000000 when I do a comparison of Time>Time2 is returning wrong result since the epoch is Time2 is greater. Please help. ... View more

host=dummy | eval Pattern='arb_usg_mps%06' | where like (source,'%Pattern%') doesnot work . can you help what's wrong in this? But events do exists. ... View more