is this what you have suggested (full query) - I am not getting any result so unsure if it is an format error. index=sne sourcetype=sne_ASAPI_elilogs Application.Channel=OA "Extended_Fields.SubChannel"=CWP-MobileApp Extended_Fields.StepInfo=getStarted NOT Extended_Fields.RegistrationType=NotSpecified | strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg | stats dc(Extended_Fields.AppId) by AcctReg as Start by host | appendcols [ search index=sne sourcetype=sne_ASAPI_elilogs Application.Channel=OA "Service.Operation"=ProcessApplication "Extended_Fields.SubChannel"=CWP-MobileApp | strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg | stats dc(Extended_Fields.AppId) by AcctReg as Finish by host ] | fillnull value=0 Finish | eval CompletionPct=(Finish/Start)*100 | eval AbandonPct=100-CompletionPct | eval CompletionPct=round(CompletionPct,2) | eval AbandonPct=round(AbandonPct,2) | table host Start Finish CompletionPct AbandonPct ... View more

Okay thankyou 🙂 ... View more

Added answer. ... View more

For btool to show search time precedence you have to specify the context (app and user). splunk btool eventtypes list --debug --app=<app> --user=<user> for example: splunk btool eventtypes list --debug --app=search --user=admin ... View more

Thanks for the update, I managed to come up with a solution by scheduling the report to generate a csv and append the same everyday to reach by visualization destination. I will also try out your opinion. Thanks ... View more

PERFECT THANKS ... View more

Hello @diogofgm , I was able to figure out that basically the JOBNAME is multivalue filed which contained both the global job XX along with actual jobs AB or DE so i just picked the actual job from the JOBNAME field using mvindex() function and then ran the stats on the actual job . This finally gave me the expected results. Thank you very much !! ... View more

See line 10? It explains it. You replace everything through line 10 with your main search and then use lines 12-13 to do what you were asking. ... View more

@NAVEEN_CTS, I am glad you found the comment useful. Personally, I prefer search with index values so that I can implement left , right, full outer join and other joins using stats command. Like | search index="A" OR index="B" Or | search index="A" AND index!="B" Or | search index!="A" AND index="B" etc. Using dc() aggregate you can only perform inner join. However, in your case since that is what you need your accepted answer should do the needful, which is the same as | search index="A" AND index="B" Do up-vote the comments if they helped 🙂 ... View more

Hi @Vijeta even this query is working fine.. I think I got the mistake with my join. Thanks a lot. ... View more

Thanks for the perfect answer. ... View more

The return value will be the value only. Usually field = value. special field：query index=* [inputlookup xxx.csv | fields col_a] ->(col_a=1) OR (col_a=2) OR (col_a=3) ・・・・ index=* [inputlookup xxx.csv | rename col_a as query | fields query] ->(1) OR (2) OR (3) ・・・・ ... View more

The above search statement does not produce that result. Please provide a complete search statement. ... View more

Works like a charm! Thank you! ... View more

Think that yould help you? https://answers.splunk.com/answers/667635/how-to-round-a-millisecond-output.html have to set "eval avg_ping=round(avg_ping,0)" to "eval avg_ping=round(avg_ping,2)" ... View more

Also join has limits and will clip your results. Friends don't let friends use JOIN ... View more

What is "send alert"? If you want to change the time range depending on the day of the week, it is easy to duplicate the alert and set the time range for each one. ... View more

Hi splunkbacon, Have a read here https://conf.splunk.com/files/2016/slides/it-seemed-like-a-good-idea-at-the-time-architectural-anti-patterns.pdf with special focus on slide 12 😉 But yes, the indexers are the real bottleneck because each real time search takes up one CPU. To prevent current and future headaches, you should forget about real time searches completely and run your alerts over short time ranges on short intervals. Hope that helps ... cheers, MuS ... View more

Hi @swetvenk, I would do something like this : | rest /servicesNS/-/search/data/lookup-table-files splunk_server="local" | search title="geo_attr*.csv" | map search="| makeresults | eval lkpnm=$title$ | append [| inputlookup $title$]| eventstats last(lkpnm) as lkpnm | search NOT _time="*"" | stats count by lkpnm ... View more

I think that you can compare in the first attempt. Try this! (index=A sourcetype="A") OR (index=B sourcetype="B") | stats dc(sourcetype) as occurrence,value(sourcetype) as sourcetypes by dest ... View more

What is the reason for using a heavy forwarder? Splunk is not good at fetching large files at once with default settings. The problem is that while importing a file, one pipeline monopolizes processing. It is necessary not to concentrate on one indexer as well as the pipeline that detects and captures logs. It is important to investigate which process is the problem. https://wiki.splunk.com/Community:HowIndexingWorks https://docs.splunk.com/Documentation/Splunk/7.2.5/Indexer/Pipelinesets https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs ... View more

Because the appendpipe [|inputlookup ...] trick that I invented somehow bypasses the subsearch limits, but the normal search will not. ... View more