Hi all,   I want to timechart the ouput of my stat command. I know that the _time field must be in the stats command when i add _time in the stats command, _time appears like a multivalue field so how can i timechart with this field ? index="X" sourcetype="Y" | stats values(A) AS NOM values(eval(round(B/60))) AS duration distinct_count(C) as cparticipant values(_time) as time by call_id | where duration >=2 and cparticipant>1 | join NOM [| inputlookup D]     here the field _time   Thx ... View more

hello everyone,   i need some help for a request.   I have a lookup which contains area country code (phone) associated to country and i want to use these area code( +33, +32,..) to extract from the "calling" field the code which is at the beginning of the number. EX: lookup.csv num country +33 France +32 Belgium +44 England +351 Portugal +216 Tunisia   Field "calling": calling +33xxxxxxxxx +351xxxxxxxxx +216xxxxxxxx +32xxxxxxxx   I want to use a rex which points to the "num" field in the lookup file and which will automatically extract the area code in the "calling" field thanks to the lookup. can we use the "num" field of the lookup file as a variable and put this variable in a rex?   I think that making a rex that identifies the first 2 or 3 is difficult because you will have to do it one by one   Thx     ... View more

Hello everyone, I want to add a string in a list which is in a field compared to another string which also is in another field. I want to add the string "webrtc" in the list in the field Type where in the field Type_call there is "web" I tried with the command eval(if(in)) but it didn't start because it replace the entire list in Type by "webrtc" How can do that, please ? Thank you ... View more