I have a log like this: (this is from search...| transaction command) [LOG|DEBUG|28 May 2015 15:42:28,722|com.XL.Source|Thread-19|-] Deal - 123456 (New,PickedUp,3) notification received from Source [END] [LOG|DEBUG|28 May 2015 15:42:40,530|com.XL.Source|EngineThread1|-] Deal - 123456 (New,PickedUp,3) - Publishing SAVED ack for the deal ... [END] This is the search: source="**.log" ("(New*,Picked*" "notification received from Source" OR "SAVED ack") | rex field=_raw "Deal -\s*(?<MW_Deal_Id>\d+) \(" | transaction MW_Deal_Id | rex field=_raw "(?<MWDealBookedByUserTime>\d+ \w+ \d+ \d+:\d+:\d+,\d+)\|com.XL.Source\|Thread-*" | rex field=_raw "(?<MWDealreceivedbyXLTime>\d+ \w+ \d+ \d+:\d+:\d+,\d+)\|com.XL.Source\|EngineThread" | eval boo=strptime(MWDealBookedByUserTime, "%d %b %Y %H:%M:%S,%N") | eval foo=strptime(MWDealreceivedbyXLTime, "%d %b %Y %H:%M:%S,%N") | eval deal_duration_time_in_min = (foo - boo)/60 | eval dealDurationinMin=if(deal_duration_time_in_min>0, deal_duration_time_in_min, "Deal Still not saved in XL") This one works fine as report, but as an alert that runs every 5 mins, it is sending false alerts. Can you please help how can avoid false alert ? i tried "grep -A" kind of search when this line is found [LOG|DEBUG|28 May 2015 15:42:28,722|com.XL.Source|Thread-19|-] but was not successful. hence I end up using above search. ... View more

Hi, I have a search which is sceduled and should send an alert. I see it running on scheduled time from job inspector but says no search results found. but if I run same search manually (for last 24hrs) I see results. The scheduled search is set to -24hr@h to now. Is "NOW" is the reason for not finding results or does it could be something else? I changed the scheduled search to -24h@h to -1m@m to find if this is the reason but I just want to ask if anyone saw this issue? The same search worked yesterday but not today. Basically it looks like it is working sometimes and not other times. Thank You. ... View more

Hi, I have these entries in the log. I am trying to extract fields FINISHED and ERROR_RUNNING for this. But I am able to get only one field FINISHED. I tried extracting fields using the interactive field extractor from GUI, but was not able to solve the issue. I even tried this: rex field=_raw " finished with status:(?<jobstatus>.*)" Can someone help? Below is an example of my log entries. finished with status:FINISHED finished with status:ERROR_RUNNING UPDATE: Here is full log entries; I tried without leading space..still had issue: Job with id: VolckerVega|FX_MASTER_StepUp|VOLCKER_TF_Y_FX_MASTER_StepUp_CancellableSwap_1|SABR_GRID_ALPHA finished with status:FINISHED Job with id: VolckerVega|MASTER|VOLCKER_TF_Y_MASTER_Swap_1|MO_CF_QTR_HDG finished with status:ERROR_RUNNING At least one job has failed. Will not exit with system code = 0 Job with id: VolckerVega|MASTER_FPA|VOLCKER_TF_Y_MASTER_FPA_FPA_1|Volcker_FPA_Vega finished with status:ERROR_RUNNING At least one job has failed. Will not exit with system code = 0 ... View more

How can this be split into key-value during search? ||| --> this marks seperation between key and value for ex: key is TRADE_VALUATION value is 9926878 EUR ValDate 9/30/13 11:59:59.999 PM EDT XXX --> marks start of different trade TRADE_VALUATION 9926878 EUR ValDate 9/30/13 11:59:59.999 PM EDT ||| NPV (493,855.68) EUR ||| ACCRUAL (-76,527.50) EUR ||| CASH (0.00) EUR ||| NOTIONAL_CURRENT (15,000,000.00) EUR ||| NOTIONAL (15,000,000.00) EUR ||| NPV_MKTING (0.00) USD ||| NPV_PAYLEG (-7,806,133.77) EUR ||| NPV_RECLEG (8,299,989.45) EUR ||| FIXED01 (-32,689.00) EUR ||| PRINCIPAL_EXCHANGE_COUNT (0) EUR XXX Trade_Valuation 10091675 GBP ValDate 9/30/13 11:59:59.999 PM EDT ||| NPV (16,129.78) GBP ||| ACCRUAL (2,755.48) GBP ||| CASH (0.00) GBP ||| NOTIONAL_CURRENT (75,000,000.00) GBP ||| NOTIONAL (75,000,000.00) GBP ||| NPV_MKTING (0.00) USD ||| NPV_PAYLEG (-426,043.90) GBP ||| NPV_RECLEG (442,173.69) GBP ||| FIXED01 (7,469.15) GBP ||| PRINCIPAL_EXCHANGE_COUNT (0) GBP Thank you. ... View more