Hello to everybody, we are trying to set a search that makes a diff between two files of two different days. This is the working search:   | set diff [| search index=myindex source="*2021-08-27*.csv" | stats count by idx | table idx] [ search index=myindex source="*2021-08-26*.csv" | stats count by idx | table idx] | join idx [ search index=myindex source="*2021-08-27*.csv"] | table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port   However, we'd like to make it parametric, we'd like dates contained in source names are calculated automatically, so we tried to insert this:   | set diff [ | eval todayFile=strftime(now(),"*%Y-%m-%d*.csv") | search index=myindex source=todayFile | stats count by idx | table idx] [ search index=myindex source="*2021-08-25*.csv" | stats count by idx | table idx] | join idx [ search index=myindex source=todayFile] | table "SITE ID",idx,"Title",FQDN,"Asset Primary Identifier","IP Address",Hostname,"Operating System", Port   but it's not working, or, better, it doesn't return errors but it doesn't return correct results either. How can we substitute source="*2021-08-25*.csv" with an instruction that dynamically inserts today date in our source filename in order to run the search every day?

Hi, how do I get subtotal count for each Host and Total for all count, in additional count for all different status. Host                            Status                             Count HostA Disconnected 1 HostA Running 19 HostA RunningWithErrors 2 HostA BadConnectivity 2 HostB Disabled 2 HostB Disconnected 1 HostB Running 17 HostB RunningWithErrors 5 HostC BadConnectivity 1 HostC Running 7 HostC RunningWithErrors 5

Hi, Is there a step-by-step procedure to know how I can setup the Ubiquiti routers, switches and the controller to send logs to Splunk? I am new and lack knowledge in how to set it up. I am using the trial version of Cloud Platform. What is your recommended approach if there are no guidelines? Thanks. Best, Borjales

Hey Splunk- community, theres another problem which must solved again. The following query.... index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" earliest=@d latest=now | where Arbeitsplatz="Arbeitsplatz Pulveranlagen" OR Arbeitsplatz="Arbeitsplatz Einhängen" OR Arbeitsplatz="Arbeitsplatz Aushängen" | transaction startswith="kommend" endswith="gehend" | eval Arbeitsbeginn="5:30:00" | eval Arbeitsbeginn_unix=strptime(Arbeitsbeginn, "%H:%M:%S") | eval Störzahl=mvcount(Störung) | search Störzahl!=2 | multireport     [ stats first(Arbeitsbeginn_unix) AS Arbeitsbeginn_unix]     [ stats sum(duration) AS "Stördauer_gesamt"]     [ search Störung="Schichtende" OR Störung="Pause"     | stats sum(duration) AS "Pausendauer"] | eval Stördauer=Stördauer_gesamt-Pausendauer | eval Arbeitszeit=now()-Arbeitsbeginn_unix-Pausendauer | eval Verfügbarkeit=round((Arbeitszeit-Stördauer)/(Arbeitszeit)*100 , 1) | table Stördauer_gesamt Pausendauer Arbeitsbeginn_unix Arbeitszeit Verfügbarkeit Stördauer ...doesn't want to calculate any fields after "| multireport ... ]". I tested  Stördauer="Stördauer_gesamt"-"Pausendauer"; Stördauer='Stördauer_gesamt'-'Pausendauer'; Stördauer=tonumber(Stördauer_gesamt)-tonumber(Pausendauer).... Nothing works. I wonder because all previous and used fields have values: Does sombody have an idea where's the problem? Thanks in advance and kind regards Felix

Hi Team, Current table Application Failure Success A 2 6 B 4 7 C 5 8   Expected Application Failure Success D 11 21   How to add the Applications values and make it as new application. Also need to sum all the failures and success values. Can anyone help on this? Regards, Madhu R