Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

query not showing all the expected results

$
0
0
Hello, i have log file that contains the following rows (im showing only those who relevant to my question)><0> 11/04/19 08:05:58 : Head Optimization Wizard: Head 6, Next Voltage = 26.477612><0> 11/04/19 08:07:47 : Head Optimization Wizard: Save voltage 26.100883 for head Head 6><5> 11/04/19 08:16:16 : E2prom - physical Head Index = 0, Part Number = 390006-010, Serial Number = 11708L0420, Head Type = Gen4 type B i'm trying to create a table with Serial Number Next Voltage Save Voltage Head Type but my search returns only Serial Number and Head Type and not Next Voltage and Save Voltage this is my query: index="pj" | search serial OR "Head Type" OR voltage NOT Disabling NOT Enabling OR "Head Optimization Wizard" OR "was selected" | rex "Serial Number = (?\S+) " | rename Type AS HeadType |append[search "Next Voltage" OR "save Voltage"] | rex "Next Voltage = (?\S+)" | rex "save Voltage = (?\S+) "|table _time LogSerialNumber HeadType NextVoltage SaveVoltage first its very very very slowly and second as i said Next Voltage and Save Voltage are empty what im missing ?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>