I have a field with the following values. How can I calculate the product i.e multiply all values with each other? There is a sum function but no multiplication. The output should be = 0.1*0.03*0.34*0.32. Thanks  0.1 0.03 0.34 0.32

Hey everyone, Currently making a report for my team that requires to have two X-Axis values based on the excel sheet shared with me. Below are some screenshots of the desired output, my progress so far, and search query based on what I have learned so far. The goal: What I am familiar with using chart in the search: My search string   | eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d") | eval _time=strptime(DATE." ","%Y-%m-%d") | where _time >= strptime("$from$", "%m/%d/%Y") AND _time <= strptime("$to$", "%m/%d/%Y") | eval epochtime=strptime(TIME, "%H:%M:%S")| eval desired_time=strftime(epochtime, "%I:%M:%S %p") | chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over desired_time  

Hi, I have a dashboard where one of the panels is generated from a |loadjob command which produces a table. This part works as normal. Now, I need to add an extra column onto the panel's table and as a result, I need to incorporate another index onto the panel's query. As result, the panel's query has both the |loadjob and also an appendcols piece that searches an index.  The extra clause is as follows: | appendcols [search index=fraud_glassbox sourcetype="gb:sessions" | stats count as email_count by Global_EmailID_CSH | eval score_email = case(email_count<2, 40, 1=1, 100) ] The issue is .... my dashboard SIGNIFICANTLY slows down in how the results are generated on the dashboard. Why would this be? Would I need an alterative to appendcols command? Many thanks,

Hello, I have this query:     | mstats avg(_value) as packets WHERE index=metrics_index sourcetype=network_metrics (metric_name=*.out) ((metric_name="InterfaceEthernetA.*" OR metric_name="InterfaceEthernetB.*") AND (host="hostA" OR host="hostB")) span=1m by metric_name,host | rex field=metric_name ".*InterfaceEthernet(?<mn>\d_\d*)" | eval kbits=packets*8/1000 | timechart span=30m sum(kbits) by mn       It returns this results:     From those results, I would like to make operations generating another column with those results...   For example: (ColumnA - ColumnB) / ColumnA * 100   How could I do that?

Hi, am trying to find list of ip's from search1 which are missing in search2 and get all the ip from search1 and calculate the percentage of missing ip's. This will help to identify the number of ip's.   Thanks in advance!

Here is my xml code so far: <form version="1.1" theme="dark"> <init> <set token="none">None</set> <set token="tokTypeInputVisible">Yes</set> <unset token="user_tok"></unset> <unset token="description_tok"></unset> <unset token="revisit_tok"></unset> <unset token="dropdown_tok"></unset> <unset token="add"></unset> <unset token="remove"></unset> <unset token="reauthorize"></unset> </init> <label>USB</label> <fieldset submitButton="false" autoRun="false"> <input type="text" token="user_tok" searchWhenChanged="false"> <label>User</label> <default></default> </input> <input type="text" token="description_tok" searchWhenChanged="false"> <label>Description</label> <default></default> </input> <input type="dropdown" token="revisit_tok" searchWhenChanged="false"> <label>Revisit</label> <choice value="select Month">Select</choice> <choice value="1 month">1 Month</choice> <choice value="2 month">2 Month</choice> <choice value="3 month">3 Month</choice> <choice value="4 month">4 Month</choice> <choice value="5 month">5 Month</choice> <choice value="6 month">6 Month</choice> <change> <condition value="1 month"> <set token="1 month"></set> <unset token="2 month"></unset> <unset token="3 month"></unset> <unset token="4 month"></unset> <unset token="5 month"></unset> <unset token="6 month"></unset> </condition> <condition value="2 month"> <unset token="1 month"></unset> <set token="2 month"></set> <unset token="3 month"></unset> <unset token="4 month"></unset> <unset token="5 month"></unset> <unset token="6 month"></unset> </condition> <condition value="3 month"> <unset token="1 month"></unset> <unset token="2 month"></unset> <set token="3 month"></set> <unset token="4 month"></unset> <unset token="5 month"></unset> <unset token="6 month"></unset> </condition> <condition value="4 month"> <unset token="1 month"></unset> <unset token="2 month"></unset> <unset token="3 month"></unset> <set token="4 month"></set> <unset token="5 month"></unset> <unset token="6 month"></unset> </condition> <condition value="5 month"> <unset token="1 month"></unset> <unset token="2 month"></unset> <unset token="3 month"></unset> <unset token="4 month"></unset> <set token="5 month"></set> <unset token="6 month"></unset> </condition> <condition value="6 month"> <unset token="1 month"></unset> <unset token="2 month"></unset> <unset token="3 month"></unset> <unset token="4 month"></unset> <unset token="5 month"></unset> <set token="6 month"></set> </condition> </change> </input> <input type="dropdown" token="dropdown_tok" depends="$tokTypeInputVisible$"> <label>Action</label> <choice value="none">None</choice> <choice value="add">Add</choice> <choice value="remove">Remove</choice> <choice value="reauthorize">Reauthorize</choice> <change> <condition value="none"> <set token="none"></set> <unset token="add"></unset> <unset token="remove"></unset> <unset token="reauthorize"></unset> </condition> <condition value="add"> <set token="add"></set> <unset token="remove"></unset> <unset token="reauthorize"></unset> <unset token="none"></unset> </condition> <condition value="remove"> <unset token="add"></unset> <set token="remove"></set> <unset token="reauthorize"></unset> <unset token="none"></unset> </condition> <condition value="reauthorize"> <unset token="add"></unset> <unset token="none"></unset> <unset token="remove"></unset> </condition> </change> <default>none</default> </input> </fieldset> <row> <panel depends="$none"> <title>USb_BAU</title> <table> <search> <query> | inputlookup USB.csv | table _time, user, category, department, description, revisit, status | lookup lookup user as user OUTPUT category department </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$add$"> <title>Add User</title> <table> <search> <query> | inputlookup USB.csv | append [ | makeresults | eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$"] | table _time, user, category, department, description, revisit, status | lookup lookup user as user OUTPUT category department | outputlookup USB.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <unset token="add"></unset> <unset token="remove"></unset> <unset token="reauthorize"></unset> </done> </search> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$remove$"> <title>Remove User</title> <table> <search> <query>| inputlookup USB.csv | where user != "$user_tok$" | table _time, user, category, department, description, revisit, status | outputlookup USB.csv </query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <unset token="remove"></unset> </done> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$revisit_tok$"> <title>Revisit User</title> <table> <search> <query> | inputlookup USB.csv | eval 1 month="$1 month$", 2 month="$2 month$", 3 month="$3 month$", 4 month="$4 month$", 5 month="$5 month$", 6 month="$6 month$" | eval status = IF((now() &lt; 1 month), "Expired","Valid") | table _time, user, category, department, description, revisit, status | outputlookup USB.csv </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> basically I am trying to figure out when a user is being added to the lookup table and you click on add, I need to check the date they were added to the month selection and if it is past the month they selected then that user is inactive and there is a reauthorize option to reactivate them on the lookup table.

Hi. I have two panel dashboard. One is general status of cluster and another one details for selected cluster.  --------- Panel 1 -------- `myapp_get_index` sourcetype="myapp:pce:metadata" myapp_type="myapp:pce:health" |stats values(status) as status by fqdn |rename fqdn as FQDN | eval "Cluster Status" = upper(substr(status,0,1)) + lower(substr(status,2)) |fields - status ----------------------- Panel 2 -------------- `myapp_get_index` sourcetype="myapp:pce:metadata" myapp_type="myapp:pce:health" fqdn=$fqdn$ | head 1 |spath path="nodes{}" output=nodes | mvexpand nodes |table nodes |spath input=nodes |eval "Uptime Day"=round(uptime_seconds/60/60,0) |table hostname, ip_address, type, cpu.percent, disk{}.location, disk{}.value.percent,memory.percent,services.running{},services.status, "Uptime Day" ----- This code works. I added transpose command to panel 1 -------------- `myapp_get_index` sourcetype="myapp:pce:metadata" myapp_type="myapp:pce:health" |stats values(status) as status by fqdn |rename fqdn as FQDN |eval "Cluster Status" = upper(substr(status,0,1)) + lower(substr(status,2)) |fields - status |transpose 5 |fields - column | rename column as FQDN,"row 1" as "FQDN 1", "row 2" as "FQDN 2", "row 3" as "FQDN 3", "row 4" as "FQDN 4", "row 5" as "FQDN 5" ------------------ It shows data as I wanted in panel1, but in panel 2 it shows details only for first FQDN regardless what I click on. ----------------------- I could not pinpoint what is missing. Thank you in advance.

A search query in Dashobard Classic when split by Trellis in Visualization tab i  gives 4 pie charts  index=log-13120-nonprod-c laas_appId=qbmp.prediction* "jobPredictionAnalysis" prediction lastEndDelta | eval accuracy_category = case( abs(lastEndDelta) <= 600, 10, (abs(lastEndDelta) > 600 and abs(lastEndDelta) <= 1200), 20, (abs(lastEndDelta) > 1200 and abs(lastEndDelta) <= 1800), 30, 1==1,40) | eval timeDistance_category = case(timeDistance < 3600, 1, (timeDistance>3600 and timeDistance<7200),2,(timeDistance>7200 and timeDistance<10800),3,1==1,4) | chart count by accuracy_category   But if the same is embedded in Dashboard Studio I have to add a where clause to create the query result in 4 parts to get 4 pie charts becuase I cannot find Trellis option. How to get 4 piecharts ( split by ... Trellis ) in Dashboard Studio ? | where timeDistance_category=1

Hi all , I got this search query which checks the time difference between two events and it works great but I would like also to see the milliseconds of that calculation but at the moment it just shows H:MM:SS "Duration" is which shows me the output from a toString eval but I would like it to show also milliseconds , anyone could help me out on this one ?       index="0200-pio_numb3r5_support-app" "HumanResourceImportJob" AND "transitioning from state 'Processing' to 'Succeeded'. Reason:" OR "transitioning from state 'Enqueued' to 'Processing'. Reason:" AND NOT OnStateUnapplied | where host="AUDIINSA4919" OR host="AUDIINSA4304" | stats earliest(_time) AS Start_time latest(_time) AS Finished_time by host | eval Latency=tostring(Finished_time-Start_time, "duration")<----- here | table Start_time , Finished_time , Latency , host | fieldformat Finished_time=strftime(Finished_time,"%d/%m/%y %H:%M:%S.%3N") | fieldformat Start_time=strftime(Start_time,"%d/%m/%y %H:%M:%S.%3N")       Output is (latency should be H:MM:SS:milliseconds) :   Start_time                                   Finished_time                            Latency           host 1 19/05/22 03:30:03.000 19/05/22 03:42:02.000 00:11:59 AUDIINSA4919

Hello Splunkers, Can somebody here tell me what the easiest way is to get MuleSoft data into Splunk if the MuleSoft data is on-prem? For example, would I be able to use a forwarder and monitor the directory, or is an integration via HEC or API possible? I also found an add-on and an app, but it doesn't say whether they're intended for MuleSoft running on-prem or in the cloud. Any help would be greatly appreciated!!