index=XX sourcetype=YY source=*/log/abc.log | dedup _time, bppm_message, bppm_nodename sortby -_indextime | rex field=bppm_operations_annotations "0x[a-z0-9]{8},(?<onepass>\w+),,(OPERATOR|OVERRIDE)_CLOSED" | rex field=bppm_operations_annotations "(OPERATOR_CLOSED:|OVERRIDE_CLOSED:|OWNERSHIP_TAKEN:)\s+(?<closed_with>(\w|\s|\-|\/|\.|\[|\])+)," | rex field=bppm_annotations "0x[a-z0-9]{8},[a-zA-Z0-9]+,(?<INC_CREATED_TSIM>.*)" | rex field=bppm_annotations "[0-9]{3}[A-Z0-9]{5},[a-zA-Z0-9]+,(?<MUTIPLE_CLOSURE_ANNOTATION>.*)" | rex field=bppm_annotations "0x[a-z0-9]{8},CME-remedy.mrl:execute AddIncidentToNotes,Incident (?<INC_CREATED_TSIM_2>(\w|\s|\-|\/|\.|\[|\])+) created by" | eval bppm_nar_close_multiple_events=if(NOT match(bppm_operations_annotations,"OVERRIDE_CLOSED") AND (NOT match(bppm_operations_annotations,"OPERATOR_CLOSED")),"yes", "no") | eval closed_with = if(isnull(closed_with) OR closed_with="Null", INC_CREATED_TSIM, closed_with) | eval closed_with = if(isnull(closed_with) OR closed_with="Null", INC_CREATED_TSIM_2, closed_with) | eval closed_with = if(isnull(closed_with) OR closed_with="Null", MUTIPLE_CLOSURE_ANNOTATION, closed_with) | fillnull value="Null" closed_with | eval time=strftime(_time,"%x-%H:%M:%S") | lookup onepasslk onepass | search bppm_ecdb_env="***" | fillnull value="Null" | stats count(bppm_message) as Total_count, count(eval(like(closed_with, "%INC%"))) as Closed-With-INC, count(eval(like(closed_with, "%CRQ%"))) as Closed-With-CRQ, count(eval(like(closed_with, "%PKE%"))) as Closed-With-PKE, count(eval(like(closed_with, "%WO%"))) as Closed-With-WO by username | sort -Total_count Abv query iam able to pull data as shown in the attached image but i want add 3 more columns Unique INC Count , Unique CRQ Count , Unique WO Count which show distinct count pls help on how to achieve this ... View more

Hi Team, Need your help | inputlookup yar_list | table Name End_date Ticket hostname | sort End_date I want to display only records which falls under current week & Next week ( 2 weeks data ) based on End_data column. Can you pls help on this. Thanks HR ... View more

Hi Team, need your help sourcetype=amc| search environment=* |top 5 showperc=f countfield="repeat_count" environment nodename environment nodename repeat_count DR Hostname1 636 Prod Hostname2 117 Prod Hostname3 108 Prod Hostname4 102 Prod Hostname5 87 who to get top 5 repeat_count host per environment [example show below] environment nodename repeat_count DR Hostname1 636 DR Hostname12 637 DR Hostname13 638 DR Hostname14 639 DR Hostname15 640 Prod Hostname21 117 Prod Hostname22 108 Prod Hostname23 102 Prod Hostname24 87 Prod Hostname25 86 ... View more

Hi Team, How to display lookup fields along with search fields. search Query index=AA* host=ABC source=/tmp/processMonitor* instance=XYZ apphome =*** | lookup boxdata host | search box_live_state="LIVE" | stats latest(state) as Status by host, apphome, instance, appmon | table host apphome instance appmon box_live_state Iam not getting anything under box_live_state, Is thr any way to display ?? boxdata box_env box_live_state box_location box_model box_os box_patch box_rack box_rfb box_ver host QA NOTLIVE ABC-DE HPXYZQ RHAS 1234 324 lxmcp 6.9 hostny01 Expecting output host apphome instance appmon Status box_live_state ABC /xy/abc abc 1 down Live Thanks Harsha ... View more

Hi Team, Need Help on run search checking server live or not using lookup boxdata box_env box_live_state box_location box_model box_os box_patch box_rack box_rfb box_ver host QA NOTLIVE ABC-DE HPXYZQ RHAS 1234 324 lxmcp 6.9 hostny01 | inputlookup boxdata | search host=hostny01 I want to show process which down only for LIVE servers. Is there a way to use abv lookup to search only Live servers. index=ab* host=pr host!=old source=processMonitor* appmon="1" instance= apphome =** | search down | stats latest(state) by host, apphome, instance, appmon** Thanks HR ... View more

Hi Team, Need your help to extract info from below event HOST=amx0001d ALIVE_STATUS=UP host amx0001d up 12.05 days at time 1498725948 last file update 2 seconds ago /home disk used 31.22 percent last update 42 seconds ago memory+swap used 3.20 percent load 0.05 0.03 0.00 threads 543 procs running 0 procs blocked 0 total CPU used over last minute 0.08 percent (16 cores) total i/o wait over last minute 0.00 percent proc up 1041226 secs, reqs: pri 28096 -mi 0 rej 0, max secs in D state: 0 Output : amx0001d STATUS = UP amx0001d up since = 12.05 days /home disk used percent = 31.22 memory+swap used percent = 3.20 load = 0.05 threads = 543 procs running = 0 procs blocked = 0 total CPU used percent = 0.08 total i/o wait percent = 0.00 Thanks ... View more

Hi Team, Below my search from which i am getting the completion time of job. Below is where i need ur help. 1 - If search won't get completion time is there a way to change the cell color. 2 - Is there a way to compare completion time with SLA time and if it is completion time is more change the color of the cell. | inputlookup PROD_BOX_CO | search Job=PROD* | rename Job AS JOB | join type=left JOB [ search index=ca* sourcetype=uc4 host=uc* U0011502 | rex "U0011502 Workflow '(?<JOB>[^']+)'" | stats max(_time) AS Completion_Time by JOB | eval Completion_Time = strftime(Completion_Time, "%+") ] | table CYCLE CheckPoint JOB SLA Completion_Time | sort Completion_Time Lookup definition Name :PROD_BOX_CO Supported fields : CYCLE,CheckPoint,Job,SLA BAT_A,BAT1,PROD.BAT.XYZ,10:30 Lookup file : PROD_BOX_CO.csv ... View more