dql help to select item in line?

[efclem]

Hello, I am new in DQL and I am hoping that somebody can help me?

I have three lines from a log that I need to monitor, Line 1 is ok there are no Unavailable Spokes.
Line 1: 7/24/26 06:23:47.864 UTC [tid=33153907] [INFO] Unavailable Spokes: None

But Line 2 and Line 3 shows that there are one or more Unavailable Spokes.
Line 2: 7/25/26 07:50:44.246 UTC [tid=33141543] [INFO] Unavailable Spokes: [SpokeServerEntry [name=SERVER-A, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1]]

Line 3: 7/27/26 07:55:12.142 UTC [tid=22945568] [INFO] Unavailable Spokes: [SpokeServerEntry [name=SERVER-B, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1], SpokeServerEntry [name=SERVER-C, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1]]

In my rapports I only want to show the following:
7/25/26 07:50:44.246 UTC Unavailable Spokes: name=SERVER-A,
7/27/26 07:55:12.142 UTC Unavailable Spokes: name=SERVER-B, name=SERVER-C

How can I do this with DQL?
Thanks for helping.

[waikeat_chan]

maybe you can try add the one line below, into your DQL

| filterOut contains(content, "Unavailable Spokes: None")

[sia_h · Accepted solution]

Try this:

data record(content="7/24/26 06:23:47.864 UTC [tid=33153907] [INFO] Unavailable Spokes: None"),
     record(content="7/25/26 07:50:44.246 UTC [tid=33141543] [INFO] Unavailable Spokes: [SpokeServerEntry [name=SERVER-A, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1]]"),
     record(content="7/27/26 07:55:12.142 UTC [tid=22945568] [INFO] Unavailable Spokes: [SpokeServerEntry [name=SERVER-B, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1], SpokeServerEntry [name=SERVER-C, configured=1, status=2, vrmf=null, platform=Windows, sessionID=-1]]")

| parse content, "LD:timestamp ' [tid=' LD '] [INFO] Unavailable Spokes: ' LD:spokes"
| filter spokes != "None"
| parse spokes, "'[' ARRAY{ 'SpokeServerEntry [' LD:entry ',' LD ']' ', '? }{0,50}:entries ']'"
| fieldsAdd Unavailable_Spokes = arrayToString(entries, delimiter:", ")
| fieldsKeep timestamp, Unavailable_Spokes

[efclem]

Many thanks, this works for me.