About vikasreddy

vikasreddy · ‎05-25-2022

Thank you! it worked, What about if we want to calculate the percentage by cell like High/A,Low/A etc? @PickleRick

vikasreddy · ‎09-13-2018

Here is the case , I have an huge XML file . In which i have extracted the events based on the tags.So i have the 3 tags header, trailer and body . So, the output will be the header section as one event and body was divide into x number of events based on the internal tag and trailer has one event . I need header section to be attached on all the events . How can we do this? Structure of the xml

vikasreddy · ‎10-30-2017

I have 2 indexes say (A1 and A2) I have Fields a,b,c,d in index A1, In the index A2 I have fields b,e,f,g . I need to pull the data of the e,f,g fields from the A2 index if "b" values present in the both the index .I don't want to use the joins. Any way we can implement this ?. Here is the sample search , what I have written but no luck .. (index=A1 fields a,b,c,d) OR (index=A2 fields b,e,f,g) | eval E=if(b==b,e,null()) | eval F=if(b==b,f,null()) | eval G=if(b==b,g,null()) | table E,F,G,b Any help would be great ..Thanks 🙂

vikasreddy · ‎08-01-2017

I have local.meta file in that i have specified the app's read permission to some Role's like 3 different roles so that the users belongs to that role can access the app. but my question is if we put read permission as * on reports ,Do those reports can be read by other roles beside 3 roles or they can be read only by app specific read roles ? Ex: [app/ui] version = 6.3.0 modtime = 1461214928.341865000 [app/launcher] version = 6.3.0 modtime = 1461214928.358444000 [] access = read : [ X1,X2,X3 ], write : [ power_role ] export = none version = 6.5.2 modtime = 1501280033.818796000 [app/package/check_for_updates] version = 6.3.0 modtime = 1461214928.365186000 [savedsearches/Sample REPORT] access = read : [ * ], write : [ power_role ] export = none owner = XXXXX version = 6.3.4 modtime = 1471988491.914745000

vikasreddy · ‎07-15-2017

@Niketnilay,Ya it is working for me, I have tried your options it is working later, I have made some tweaks in my code suggested by DalJeanis.

vikasreddy · ‎07-15-2017

Thank you DalJeanis, For you quick reply. It was awesome the whole thing can be done with single line.

vikasreddy · ‎07-14-2017

Ya, it worked Thank you Niketnilay.

vikasreddy · ‎07-14-2017

I need to extract the date from the file name,But the format of the data on different files are different for eg:D20171202 is one file format,other one is D171203. I am extracting the date using regex and using eval match function I am changing the date format it is working fine , but it is changing some files date only. below is the code I used index=xyz source=a | rex field=oldsorcefile"._D(?\d{8})." |eval FDate2=case(macth(FDate1,"20*")FDate1,match(FDate,"17*"),("20"+(FDate1))) | table Fdate1,FDate2 Here is the Sample output... FDATE1 FDATE2 17071318 2017071318 17071418 2017071418 20170714 20170714 20170712 20170712 17071216 17071216 it is working fine but some dates are not changing according to code. any help would be great full. Thanks

vikasreddy · ‎02-19-2017

I am not able to go forward , Here is my detail explanation I have a Index A from which i have to take a field name Say "Sample". In index B I have to extract a field using rex with same name "Sample". the thing is when we using OR it is extracting the field sample from one index only i.e index B . how to get field and values from both the index? detail query (index= A sourcetype=xyz) OR (index=B sourcetype=cdf ) |rex"^)?P[^,]*) i have written the query in this type when i ran it's show data from ony index B .how can i get data from both the index ?

vikasreddy · ‎02-18-2017

But My Question is how can I do that?

vikasreddy · ‎02-18-2017

I have two indexers where i have to compare one field among them.I don't want to use join,Instead of that i used OR condition But the thing is from one of the index I have to extract a field using rex during search time .How can I do that. index A Sample Field (this field already present in the index ) index B I have to extract the field Here is the sample Query (index=A sourcetype=xyz) OR (index=B sourcetype=ABC ) | rex "doc_name:\"(?[^+]+)" when I am doing this it is considering only one index data i.e only from B index it is taking data. How can I over come this?

vikasreddy · ‎12-24-2016

Hi Team, I just want to know is there any limit for the "NOT" operator, same like join has? if yes, what is the limit? Thank you.

vikasreddy · ‎11-01-2016

I have created a dash board. On that I have to create a "Button" on that created panel.when I press the button, New window has to be open and it should display some text content.I think it is simple task but I am not able to crack it. I don't know from where I have to start? can anyone help me in detail steps about this? Thanks!

Posts	14
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎05-01-2016

Online Status	Offline
Date Last Visited	‎05-25-2022 01:13 PM

search for converting the column to rows :

How can we add the first event to all existing eve...

Alternative to Joins

role Permission on local.meta

Eval Match function Issue

Can we Regex while using "OR"

Is there any limit for the "NOT" operator?

Can any one explain me how to create a button on d...

Re: Alternative to append

How can we add the first event to all existing eve...

Alternative to Joins

role Permission on local.meta

Re: Eval Match function Issue

Re: Eval Match function Issue

Re: Eval Match function Issue

Eval Match function Issue

Re: Can we Regex while using "OR"

Re: Can we Regex while using "OR"

Can we Regex while using "OR"

Is there any limit for the "NOT" operator?

Can any one explain me how to create a button on d...