Hi @Ashish0405 , at first you don't need dedup before stats: index="network" %BGP-5 *clip*
| rex field=_raw "^(?:[^ \n]* ){4}(?P<Device_name>[^:]+)"
| stats count by Device_name src_ip state_to
...
See more...
Hi @Ashish0405 , at first you don't need dedup before stats: index="network" %BGP-5 *clip*
| rex field=_raw "^(?:[^ \n]* ){4}(?P<Device_name>[^:]+)"
| stats count by Device_name src_ip state_to
| eval
primarycolor=case(state_to="Down", "#D93F3C", state_to="Up", "#31A35F"),
secondarycolor=primarycolor then, what do you mean with flat time? if the time borders of your search, you can use addinfo command (https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/Addinfo) that with the info_min_time and info_max_time fields gives you the time borders of your search. index="network" %BGP-5 *clip*
| rex field=_raw "^(?:[^ \n]* ){4}(?P<Device_name>[^:]+)"
| stats count by Device_name src_ip state_to
| eval
primarycolor=case(state_to="Down", "#D93F3C", state_to="Up", "#31A35F"),
secondarycolor=primarycolor
| addinfo
| table Device_name src_ip state_to count primarycolor secondarycolor info_min_time info_max_time Ciao. Giuseppe