New comment on reddit

Could you please edit this search into your question – so it's not a fifty-screen-wide string? 🙂

index=hcnc_rds_db sourcetype=rds_test | eval epoch_file_info_created_at=strptime(file_info_created_at, "%Y-%m-%d %H:%M:%S.%3Q")-14400, epoch_file_info_modified_at=strptime(file_info_modified_at, "%Y-%m-%d %H:%M:%S.%3Q")-14400 | streamstats latest(*) as * by interface_id, epoch_file_info_created_at | eval early_start_epoch=relative_time(epoch_file_info_created_at,"@d"), late_start_epoch=relative_time(epoch_file_info_created_at,"@d"), recurrence_pattern_epoch=relative_time(epoch_file_info_created_at,"@d") | croniter iterations=1 input=early_file_delivery_time start_epoch=early_start_epoch | rename croniter_return as epoch_early_file | croniter iterations=1 input=late_file_delivery_time start_epoch=late_start_epoch | rename croniter_return as epoch_late_file | croniter iterations=1 input=recurrence_pattern start_epoch=recurrence_pattern_epoch | rename croniter_return as epoch_recurrence | fields - early_file_delivery_time | eval epoch_early_file=epoch_early_file+14400, epoch_late_file=epoch_late_file+14400, epoch_recurrence=epoch_recurrence+14400 | fieldformat epoch_early_file =strftime(epoch_early_file, "%Y-%m-%d %H:%M:%S.%3Q") | fieldformat epoch_late_file =strftime(epoch_late_file, "%Y-%m-%d %H:%M:%S.%3Q") | fieldformat epoch_recurrence =strftime(epoch_recurrence, "%Y-%m-%d %H:%M:%S.%3Q") | eval date_reference=strftime(epoch_file_info_created_at, "%Y-%m-%d"), process_time=epoch_file_info_modified_at-epoch_file_info_created_at | eval results=case(validation_error="FILE_TYPE_MISMATCH", "Failure", epoch_file_info_created_at>epoch_early_file AND epoch_file_info_created_at<epoch_late_file, "Success", epoch_file_info_created_at<epoch_early_file, "Warn", process_time>300 AND process_time<1800, "Success", 1=1, "Not Run") | eval combined=interface_id."@".integration_name."@".priority."@".service_area."@".source_sys_name."@".target_sys_name."@" | xyseries combined date_reference results | rex field=combined "^(?<interface_id>[^\@]+)\@(?<integration_name>[^\@]+)\@(?<priority>[^\@]+)\@(?<service_area>[^\@]+)\@(?<source_sys_name>[^\@]+)\@(?<target_sys_name>[^\@]+)\@$" | fillnull value="Not Run" | eval alert_sent=if(isnull(alert_sent), "No", alert_sent) | eval status=if(isnull(status), "Not Run", status) | eval ticket_id=if(isnull(ticket_id), "No", ticket_id) | table interface_id, integration_name, priority, service_area, source_sys_name, target_sys_name [ makeresults | addinfo | eval time = mvappend(relative_time(info_min_time,"@d"),relative_time(info_max_time,"@d")) | fields time | mvexpand time | makecontinuous time span=1d | eval time=strftime(time,"%F") | reverse | stats list(time) as time | return $time ] | rename interface_id as "Service ID", integration_name as "Service Name", priority as "Priority", service_area as "Service Area", source_sys_name as "Source", target_sys_name as "Target"