Trying to extract Dimensions out of Query, but it is taking 1500 plus steps due to which I am getting limits.conf error.     [{(, ](?<Dimensions>[a-z0-9A-Z\[\.\]+[\-\ \_]*)[\.&\[] SELECT { [Measures].[IMS Org Count] } ON COLUMNS, NONEMPTY ( { [End User].[End User ID].[End User ID].MEMBERS * [End User].[End User Name].[End User Name].MEMBERS * [Product].[PMBU Short Desc].[PMBU Short Desc].MEMBERS * [Product].[PMBU Medium Desc].[PMBU Medium Desc].MEMBERS * [IMS Org].[Unique Id].[Unique Id].MEMBERS * [IMS Org].[IMS Org Id].[IMS Org Id].MEMBERS * [IMS Org].[MC Org Name].[MC Org Name].MEMBERS * [Is Active Account].[Is Active Account].[Is Active Account].MEMBERS* [Billing End User].[End User ID].[End User ID].MEMBERS } , [Measures].[IMS Org Count] ) ON ROWS FROM ( SELECT CASE '1' WHEN "5" THEN [Account Manager].[AM Org Lead Ldap].[AM Org Lead Ldap].[xxxx] WHEN "4" THEN [Account Manager].[Regional Manager Ldap].[Regional Manager Ldap].[xxx] WHEN "3" THEN [Account Manager].[AM Manager Ldap].[AM Manager Ldap].[xxx] WHEN "2" THEN [Account Manager].[AM Lead Ldap].[AM Lead Ldap].[xxx] WHEN "1" THEN [Account Manager].[AM Ldap].[AM Ldap].[xxxx] END ON 0 FROM XX )     https://regex101.com/r/HEdUhy/1/ ... View more

I am trying to extract 2 different time from extend event logs 1. Processing time taken by Server. ( "Finished processing the" OR EventClass=COMMAND_END ) 2. Time taken by Seleect query ("TextData=*SELECT" ) First Query index=xxx sourcetype=extendedevent ( "Finished processing the" OR EventClass=COMMAND_END ) DatabaseName="DbName" | eval ObjectName=if(isnull(ObjectName), "Full_Processing_time",ObjectName) | eval Date=strftime(_time,"%d/%m/%y") | eval Duration=round(tonumber(Duration)/1000/60,2) |chart limit=0 max(Duration) AS D BY ObjectName Date Second Query index=xxx sourcetype=extendedevent ( "TextData=*SELECT") DatabaseName="DbName" | eval Date=strftime(_time,"%d/%m/%y") | eval Duration=round(tonumber(Duration)/1000/60,2) |chart limit=0 max(Duration) AS D BY ObjectName Date I want to show these 2 timings per object per day (7 or 30 day's of report.) I am not able to combine and show What i have tried is index=xxx sourcetype=extendedevent ( "Finished processing the" OR EventClass=COMMAND_END ) DatabaseName="DbName" | eval ObjectName=if(isnull(ObjectName), "Full_Processing_time",ObjectName) | eval Date=strftime(_time,"%d/%m/%y") | eval SSAS_Processing=round(tonumber(Duration)/1000/60,2) | append [ search index=xxx sourcetype=extendedevent ( "TextData=*SELECT") DatabaseName="DbName" | eval Date=strftime(_time,"%d/%m/%y") | eval Select_Query=round(tonumber(Duration)/1000/60,2) ] | chart max(SSAS_Processing) AS SSAS_Processing, max(Select_Query) AS Select_Query BY ObjectName ,Date ... View more

I am trying to plot chart by ObjectName , Date by Duration. And wanted to sort them by Date desc and Duration desc. I am not able to get same. some search .....| eval ObjectName=if(isnull(ObjectName), "Full_Processing_time",ObjectName) |eval Date=strftime(_time,"%d/%m/%y") | eval Duration=round(tonumber(Duration)/1000/60,2) | chart max(Duration) as D by ObjectName,Date | sort 0 D Date | fields - D Date ... View more

Below is my i/p file { "Count": 2, "Items": [ { "total_time": { "S": "0.000s" }, "start_date_time": { "S": "2017-09-19 05:00:43" }, "bad_records": { "N": "0" }, "successful_records": { "N": "0" }, "source": { "S": "mps_dnc" }, "end_date_time": { "S": "2017-09-19 05:00:43" }, "file_name": { "S": "No File" }, "total_records": { "N": "0" }, "job_name": { "S": "mps_dnc_out" } }, { "total_time": { "S": "12.783s" }, "start_date_time": { "S": "2017-09-19 11:42:21" }, "bad_records": { "N": "0" }, "successful_records": { "N": "12094" }, "source": { "S": "mps_dnc" }, "end_date_time": { "S": "2017-09-19 11:42:34" }, "file_name": { "S": "do_not_contact_list_2017-09-19T11_42_20.581Z.txt" }, "total_records": { "N": "12094" }, "job_name": { "S": "mps_dnc_out" } } ], "ScannedCount": 2, "ConsumedCapacity": null } Below is my probs.conf and limit .conf [spath] number of characters to read from an XML or JSON event when auto extracting extraction_cutoff = 10000 cat props.conf [dynamoout] TRUNCATE = 0 KV_MODE = json NO_BINARY_CHECK = true SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]*) DATETIME_CONFIG = CURRENT [source::/script_logs_mps/.] CHECK_METHOD=entire_md5 Still on splunk i can see only 8 lines. ... View more