I am trying to parse some data for API latency. I have a value for "elapsedTime" which spits that out. However if a request takes longer than 999ms, then it changes to reporting in seconds. So... the query below could return 999ms or 1.001s. What eval statement do I need here to parse the value of elapsedTime and if it contains "s" and not "ms",  then * 1000 to get a value in ms... | NEED SOME EVAL HERE I GUESS | stats min(elapsedTime) as Fastest max(elapsedTime) as Slowest avg(elapsedTime) as "Average"

I am looking to audit any user that uploads to splunk through the User interface or REST API  After doing some investigation I have found that the endpoints /services/app/local is the REST API endpoint that can be used to post an application. I was wondering whether splunk internally posts to that API when you utilise the GUI so by auditing that log you can get both use cases.  I have crafted the below search to isolate these events and confirmation that this works would be awesome! index=_internal sourcetype=splunkd_access /services/apps/local method=POST Appreciate all assistance. 

This is a bit of a long shot, but I was curious to get the community's input. Today, I realized that both Slack and PasteBin use "codemirror" to handle their web code editor / syntax highlighting. With PasteBin, I had to examine the page source to confirm. With Slack, you can confirm it here: https://slack.com/libs/webapp I figured I would submit a feature request to codemirror to see if they could add a "language mode" for Splunk. However, my issue was immediately closed with the response that codemirror does not implement new language modes, and it would be better implemented via a separate package. So I guess someone will have to create and maintain a language mode for codemirror for others to use if they want SPL support. Unfortunately, I do not have the experience to do this. But looking around, it appears GraphQL built their own codemirror language code package...so I was thinking...even if it's a long shot, maybe I can send the idea to Splunk and see what happens. Where would be the appropriate place to send this suggestion in to Splunk to see if that's something they'd be interested in implementing? I tried checking the ideas submission, but there are no categories where this idea would fit. I think it would be awesome if one day we could have Splunk syntax highlighting support in Slack (and also PasteBin, but there's a lot less people using that lol).

Here is my kv store lookup  name rating comment experience  subject A 3 good 4 math B 4 very good 7 science   now i want to append new row like this with different rating name rating comment experience  subject A 3 good 4 math B 4 very good 7 science A 5 Excellent  4 math   i am trying to use      | inputlookup table_a |search name="A" |eval rating=5 ,comment="Execellent" key=_key| outputlookup append=true key_field=key table_a     But this is not working..Please someone help me with this..   Thanks

I need to find abnormalities in my data. The data I have is individual views for certain movie titles. I need to find content that was abnormally popular over some small time interval, say 1 hour. And check a few weeks worth of data. One option is to run a query manually for each hour       ``` Run this over 60m time window ``` index=mydata | top limit=100 movieId       Obviously I don't want to run this query 24 * 7 = 168 times for one weeks worth of data. How can I bin the data into time buckets, and get a percentage ratio by movieId? This is what I came up with:       ``` Run this over 1+ week ``` index=mydata | bin span=60m _time | top limit=100 movieId, _time       This does not help me because the output of `top` is showing me a percentage based on the entire input set of data. I need a "local" percentage, i.e. a percentage based on only that slice of data in the bin.   I'm wondering if eventstats or streamstats can be useful here but I was not able to come up with a query using those commands