'Macro1' rex "PT(?P[0-9.]+)" | eval cil_services=substr(rtrim(service,"PS"),4) | eval respTime=ltrim(rtrim(timeDiff,"S"),"PT") | rename Date_CIL as Date, uri_path as Service, CIL_MethodName as Method, response_time as Response_Time | table CIL_RequestID, Date, Service, Method, Response_Time
'Macro2' | rex "PT(?P[0-9.]+)" | eval cil_services=substr(rtrim(service,"PS"),4) | eval respTime=ltrim(rtrim(timeDiff,"S"),"PT") | rename field1 as Date, field33 as Service, CAM_MethodName as Method, ResponseTime_CAM as Response_Time | table Date, Service, Method, Response_Time
CIL_RequestID field is present in both with different names.
... View more