topic dql help to select item in line? in Developer Q&A Forum

dql help to select item in line?

efclem — Wed, 29 Jul 2026 07:07:40 GMT

Hello, I am new in DQL and I am hoping that somebody can help me?

I have three lines from a log that I need to monitor, Line 1 is ok there are no Unavailable Spokes.
Line 1: 7/24/26 06:23:47.864 UTC [tid=33153907] [INFO] Unavailable Spokes: None

But Line 2 and Line 3 shows that there are one or more Unavailable Spokes.
Line 2: 7/25/26 07:50:44.246 UTC [tid=33141543] [INFO] Unavailable Spokes: [SpokeServerEntry [name=SERVER-A, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1]]

Line 3: 7/27/26 07:55:12.142 UTC [tid=22945568] [INFO] Unavailable Spokes: [SpokeServerEntry [name=SERVER-B, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1], SpokeServerEntry [name=SERVER-C, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1]]

In my rapports I only want to show the following:
7/25/26 07:50:44.246 UTC Unavailable Spokes: name=SERVER-A,
7/27/26 07:55:12.142 UTC Unavailable Spokes: name=SERVER-B, name=SERVER-C

How can I do this with DQL?
Thanks for helping.

Re: dql help to select item in line?

waikeat_chan — Wed, 29 Jul 2026 07:21:49 GMT

maybe you can try add the one line below, into your DQL

| filterOut contains(content, "Unavailable Spokes: None")

Re: dql help to select item in line?

sia_h — Wed, 29 Jul 2026 07:26:51 GMT

Try this:

data record(content="7/24/26 06:23:47.864 UTC [tid=33153907] [INFO] Unavailable Spokes: None"), record(content="7/25/26 07:50:44.246 UTC [tid=33141543] [INFO] Unavailable Spokes: [SpokeServerEntry [name=SERVER-A, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1]]"), record(content="7/27/26 07:55:12.142 UTC [tid=22945568] [INFO] Unavailable Spokes: [SpokeServerEntry [name=SERVER-B, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1], SpokeServerEntry [name=SERVER-C, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1]]") | parse content, "LD:timestamp ' [tid=' LD '] [INFO] Unavailable Spokes: ' LD:spokes" | filter spokes != "None" | parse spokes, "'[' ARRAY{ 'SpokeServerEntry [' LD:entry ',' LD ']' ', '? }{0,50}:entries ']'" | fieldsAdd Unavailable_Spokes = arrayToString(entries, delimiter:", ") | fieldsKeep timestamp, Unavailable_Spokes

Re: dql help to select item in line?

efclem — Thu, 30 Jul 2026 06:12:36 GMT

Many thanks, this works for me.