Thanks for the reply Soutamo. I ran this query but it is showing every other event along with the main events I mentioned in my post.  The output table is loaded with all default fields along with manually extracted fields; but I need only the fields mentioned in the table. Note: In my post, I mentioned only the needed events. ... View more

Hi Badri, Thanks for your reply, The query is kinda working fine, now I am trying to figure out the response time which is end_time - begin_time. For that I am using the below query, --above query--|eval response_time=strptime(end_time,"%Y-%m-%d %H:%M:%S.%3N") - strptime(begin_time,"%Y-%m-%d %H:%M:%S.%3N") |table begin_time, end_time , response_time. but the response_time column is coming empty, not sure what went wrong. ... View more

Hi Alemarzu, Here is my actual sample first and last logger statements, [INFO ] 2017-11-02 10:58:16,071 - com.aetna.eie.vtwoprovider.helper.util VTwoProviderRule 87675606-ddcc-4841-a925-96aac6a1a395-L7 MainflowOUT Exit the Ruleflow [INFO ] 2017-11-02 10:58:16,071 - com.aetna.eie.vtwoprovider.helper.util VTwoProviderRule 87675606-ddcc-4841-a925-96aac6a1a395-L7 MainflowIN Into the Ruleflow where the highlighted is the string decided whther the logger is first statement or last. Here is my search query, ((com.aetna.eie.vtwoprovider.helper.util VTwoProviderRule * "MainflowIN Into the Ruleflow") OR (com.aetna.eie.vtwoprovider.helper.util VTwoProviderRule * "MainflowOUT Exit the Ruleflow")) |rex "]\s(?P\d+-\d+-\d+\s+\d+:\d+:\d+,\d+)(?=\s+-\s+\w+.\w+.\w+.\w+.\w+.\w+\s+\w+\s+ )" if I try to hard code "MainflowIN" or "MainflowOUT" at the end of the query the results are blank, if I don't add this string results are coming but my ultimate goal is not achevied, please help. ... View more

Hi @Alemarzu, Thanks for your reply, The rex is giving result till this portion | rex "]\s(?[\d\/\s:]+)(?=,\s\d+\s , but if I append \"Starting, it is producing empty results, what went wong?? ... View more